Zimbra Server very slow - Too many SMTP connections

[pc-nico]

Hello,

in the last days my (up2date) Zimbra Server is very slow. The WebInterface
is low.

The load is always up 2,xx 2,xx 2,xx
On TOP the CPU Usage ist most under 15%
most unter 5 Processes are Running
The Server has 2 XEON 3,4GHz CPUs and 2048 MB Ram.
It host 25 Users...

How can i check, why the server is so low.

[uxbod]

What does the command free report ?

[pc-nico]

             total       used       free     shared    buffers     cached
Mem:       2074900    2007688      67212          0      39516     751324
-/+ buffers/cache:    1216848     858052
Swap:      2031608       6652    2024956

[nrc]

The output of this may be helpful as well:

top -b -n1 | head -20

You have a little swap in use but you have memory available in buffers and cache that hasn't been reclaimed so that may just be from long running processes (if you've been a up a while).

[pc-nico]

the master problem was, that anybody starts a Spam Attack and using our info@ - E-Mailaddress as sender.

This cause that over 1600 mails come in between a little time.

Amavis was hard working, but the mailqueue going up and up...
I don´t have tweak anything in Zimbra...

I it useful to enhance the number of amavis processes? Why the CPU
always used max 50% in this time where amavis was hard working...

[uxbod]

When this happens you will also see that ClamAV is working very hard aswell.

Have a read of Improving Anti-spam system - Zimbra :: Wiki as you could easily reduce the amount of work Amavis is performing by implementing a few of the Postfix tweaks. This can be enhanced further by implementing RBL checking at the Postfix level aswell.

Hope this helps.

[pc-nico]

i only have added the Postfix Tweaks in the wiki-page you have post...

Today the mailq ist empty but the load ist anyway over 2,x
The WebIF ist very slow and if i want to send a message, i get
a windows "Waiting for the Server" after a while recive the error message:

msg: system failure: MessagingException
code: service.FAILURE
method: SendMsgRequest
detail: soap:Receiver
trace: btpool0-19:1212645891895:66465e1962f4d51d

but the mail goes out!

[uxbod]

Please check your Log Files - Zimbra :: Wiki for any error messages. Are the clients remote from your site or local ? Are you able to test on the local LAN direct to the server ? Do the connections go through a proxy or firewall ?

[pc-nico]

all clients are local connected in your intranet to the server.... i have check the logs, but i don´t know what i search for...

their are a lots of messages in /var/log/zimbra.log like thes

Jun  5 08:28:12 mail postfix/smtpd[21541]: lost connection after RCPT from unknown[89.148.228.3]
Jun  5 08:28:12 mail postfix/smtpd[21541]: disconnect from unknown[89.148.228.3]
Jun  5 08:28:12 mail postfix/smtpd[11545]: lost connection after RCPT from kon-26-89.svserv.net[79.170.26.89]
Jun  5 08:28:12 mail postfix/smtpd[11545]: disconnect from kon-26-89.svserv.net[79.170.26.89]
Jun  5 08:28:12 mail postfix/smtpd[3881]: connect from unknown[92.47.82.149]
Jun  5 08:28:12 mail postfix/smtpd[3882]: connect from unknown[211.55.23.230]
Jun  5 08:28:12 mail postfix/smtpd[573]: lost connection after RCPT from 87-119-227-204.saransk.ru[87.119.227.204]
Jun  5 08:28:12 mail postfix/smtpd[17857]: lost connection after RCPT from ppp92-100-58-180.pppoe.avangarddsl.ru[92.100.58.180]
Jun  5 08:28:13 mail postfix/smtpd[573]: disconnect from 87-119-227-204.saransk.ru[87.119.227.204]
Jun  5 08:28:12 mail postfix/smtpd[31609]: lost connection after RCPT from p4FCF43ED.dip0.t-ipconnect.de[79.207.67.237]
Jun  5 08:28:12 mail postfix/smtpd[620]: lost connection after RCPT from cpe-72-177-56-19.austin.res.rr.com[72.177.56.19]
Jun  5 08:28:12 mail postfix/smtpd[30797]: lost connection after RCPT from 237-83-124-91.pool.ukrtel.net[91.124.83.237]
Jun  5 08:28:12 mail postfix/smtpd[20043]: lost connection after RCPT from euromixkr.dp.ua[193.34.21.128]
Jun  5 08:28:13 mail postfix/smtpd[20043]: disconnect from euromixkr.dp.ua[193.34.21.128]
Jun  5 08:28:13 mail postfix/smtpd[17857]: disconnect from ppp92-100-58-180.pppoe.avangarddsl.ru[92.100.58.180]
Jun  5 08:28:12 mail postfix/smtpd[12185]: lost connection after RCPT from unknown[121.152.173.167]
Jun  5 08:28:13 mail postfix/smtpd[12185]: disconnect from unknown[121.152.173.167]
Jun  5 08:28:13 mail postfix/smtpd[17733]: lost connection after RCPT from unknown[218.154.57.253]
Jun  5 08:28:13 mail postfix/smtpd[31609]: disconnect from p4FCF43ED.dip0.t-ipconnect.de[79.207.67.237]
Jun  5 08:28:13 mail postfix/smtpd[31637]: lost connection after RCPT from unknown[222.109.83.126]
Jun  5 08:28:13 mail postfix/smtpd[31637]: disconnect from unknown[222.109.83.126]
Jun  5 08:28:13 mail postfix/smtpd[620]: disconnect from cpe-72-177-56-19.austin.res.rr.com[72.177.56.19]
Jun  5 08:28:13 mail postfix/smtpd[30797]: disconnect from 237-83-124-91.pool.ukrtel.net[91.124.83.237]
Jun  5 08:28:12 mail postfix/smtpd[31447]: lost connection after RCPT from umbrellaness.upkeep.volia.net[77.122.21.105]
Jun  5 08:28:13 mail postfix/smtpd[31447]: disconnect from umbrellaness.upkeep.volia.net[77.122.21.105]
Jun  5 08:28:13 mail postfix/smtpd[17733]: disconnect from unknown[218.154.57.253]
Jun  5 08:28:12 mail postfix/smtpd[13023]: lost connection after RCPT from unknown[117.197.208.231]

[uxbod]

You are getting a lot of connections. You should look at throttling the connections either by using Postfix or PolicyD. Do you just have one NIC in your server ? Is it on a private or public IP ?