[SOLVED] postfix outbound queue...where is it???

[tomo89aus]

Hi,

Release 5.0.7_GA_2444.RHEL4_64_20080626023050 RHEL4_64 FOSS edition

Last week our ISP blocked us on their SMTP server for SPAM abuse. They said the same message was sent over 700 times. The forwarded a copy to me and it originated from one of our staff through their zimbra account. I confirmed they only sent it once so assumed it was a one off glitch with Zimbra. Our internet connection was very sluggish while this was going on.

We have been using zimbra for 18 months and this is the first time we've had this problem. We recently upgraded the server hardware and zimbra version about 3 months ago.

I came in this morning...once again the internet is sluggish. So I stopped postifx on the zimbra server and voila the internet is fine.

Now the problem is I don't how to stop postfix from sending this continual email, if I start postfix again, within a few minutes it is resending.

postqueue -p says the queue is empty

please help me find this rogue message!

Thanks,

Thomas

EDIT: stopping postfix has not fixed the problem...the emails are still continually sending. Where do outbound emails sit on zimbra?

[tomo89aus]

see wireshark screenshot.....WEIRD! this was with postfix not running (verified with zmcontrol status). sendmail isn't running either. Where is this smtp traffic originating from?

[Baylink]

lsof | grep IPv4

should give you a hint, I think.

[tomo89aus]

Ok so this problem occurred another 2 or 3 times before I finally figured out the cause. It was a zimbra desktop client having some issues (not sure what specifically just yet). I shutdown the zimbra desktop service on the client, stopped postfix on the server and then started it again...rogue message gone everything back to normal.

Hope this helps someone if it happens to you.