weird disk usage and message volume

[phingers]

I am experiencing two problems on my zimbra server, and I think they are inter-related.

1) once a week or so, my server sends out notifications to me that the disk space is getting critical. I get about 20-50 emails, all with increasing percentages of disk usage, all the way up to 100%

By the time I've reviewed these emails and log into the system, it is back down to around 55% where it usually is.

2) My message volume statistics show 15,000 - 30,000 messages, with monthly stats in the millions. There is no way my server's users are actually sending out that many, we have less than 100 accounts on it. So how do I track down how or who is sending these messages?

I appreciate anyone's thoughts in helping me figure this out.

thanks!

[ArcaneMagus]

Try looking in the log files like /var/log/zimbra.log or /opt/zimbra/log/mailbox.log. Anything going through the MTA should be in /var/log/zimbra.log...

[phingers]

Thanks for the tips, I've been looking at the logs, but they are very large files, and I dont 100% know what I'm looking for.

Do I look for some kind of outgoing message statement, then do a count on that by user or something?

Just need to figure out a little more about what I'm looking for in the logs to figure this out.

There is no user sending status flag or count in the statistics screens someplace right?

That would be a nice feature, keep track of which user is using most of the system etc.

[phoenix]

Originally Posted by phingers

There is no user sending status flag or count in the statistics screens someplace right?

You should be receiving a daily mail report to the Admin account that details the message counts for users.

[phingers]

cat zimbra.log | grep to= | wc -l

Seems to show from Sep 18 to Oct 9

The server sent out 62495 emails

Seems rather high, so now I just weed through that list and look for suspicious ones?

[ArcaneMagus]

This should give you the log lines of when a message was sent out if you have Zimbra's amavis enabled:

cat zimbra.log | grep "Passed CLEAN, LOCAL"

As for per user statistics, you can either build a script that parses it, or just look at the account sizes in the server specific stats page and estimate from that.

cat zimbra.log | grep to= | wc -l

will show all messages, both sent and received.

[phingers]

So the issue just happened again, disk space spun up from 61% to 100%, zimbra seems to stop and restart itself.

I check the zimbra log files for sent

the clean local search seems to find about 10 messages or so

and the count of send/recieved wc -l command came back with 90,598

So I guess I'll see what the mail report says in the morning? 90k seems very high, esp for a sat.

[veronica]

Backup does happen every weekend. You might want to have a look there as well. There are 2 entries incase you are using standard backup. It takes full backup and then later deletes one month old backup. It might be the case that backup fills all space and then later deletion for old ones frees up space.

[phingers]

So I've seen this issue happen during the day a few times, but mostly at night from around 3-5am, so my hunch is that it is the backups, but I don't know why it would be happening during the day.

How do I adjust the backups etc? To correct for this? Add another disk and put the backups there?

[phingers]

I'm still having this issue although less frequently now.

Any thoughts, it is just totally bizarre to receive about 150 disk warning messages, watching the disk usage via email go from 56% to 100% - seeing zimbra restart the services itself.

The emails come in about 2 hours later, and when I log in to check things out the server seems fine, disk space is at 56%.