Unusually high message count

[zajmedia]

Hi all,

We have been experiencing a regular occurence of very high message counts (100.000+ on certain days). I have tried checking logs but can't really see anything unusual - I am not sure though that I am looking in the right place. We have no open relay on the server, and all software is up-to-date (including Zimbra).

Plus, it just does not add up. In the last 24 hours message volume stats report that we had GB of data - our actual outgoing data (calculated by our server host) is a very normal few hundred MBs.

Finally, looking at Advanced Statistics / zmmtastats / mta_count, I get a "normal" number (perhaps a bit low actually). So I'm confused about this stat then...

So any ideas on what's going on here?

Thanks!

[peracchi]

Hi!

Same problem here...

On "Advanced Statistics / zmmtastats / mta_count " I get "normal" values (less than 250 messages).

But on "Message Count" I get 237,122 messages! :O

It´s a known bug?

[uxbod]

Please update your profile with the following

su - zimbra
zmcontrol -v

so we know which version of Zimbra you are running? have you checked /var/log/zimbra.log to see whether that many emails have indeed been relayed ?

[nmirceac]

i have the same problem

apparently each time i `zmcontrol restart` there is a huge increase in the server stats graphs (spam/message count/volume)

[jimmyk]

Between 2pm and 4pm each night my message count goes from around 50 messages to 1900 messages!

I have been checking logs to find any clues to the machine being hacked. All the logs are present and fine as far as i can tell and the mail gateway in the dmz also seems fine with no abnormal logs.

My ISP's bandwidth usage is also not showing anything to suggested that my Zimbra server is spamming during the night.

It does look like a bug with Zimbra, but it is making me look at the logs very closely each day.

jk

[nmirceac]

Originally Posted by jimmyk

Between 2pm and 4pm each night my message count goes from around 50 messages to 1900 messages!

I have been checking logs to find any clues to the machine being hacked. All the logs are present and fine as far as i can tell and the mail gateway in the dmz also seems fine with no abnormal logs.

My ISP's bandwidth usage is also not showing anything to suggested that my Zimbra server is spamming during the night.

It does look like a bug with Zimbra, but it is making me look at the logs very closely each day.

jk

let me guess...
at 2:30-3 you have scheduled the daily backup, process in which you have at one point these commands included
zmcontrol stop
#doing backup stuff
zmcontrol start

[jimmyk]

Just thinking about backup's at the moment causes me some stress. My backup strategy at the moment is to rely on brand new hardware!!!

So - no, this issue (at least for me) is not related to a backup script of some sort.

Backups are next on the list for me and the hardware is now available for me to start looking into this - Zimbra was well received at small business i converted to Zimbra. Hopefully, my next post will not be - How do i recover........?

If any Zimbra employee's are on this forum i would be interested to know is this issue is present in the Starter Edition of Zimbra?

Apologies if this thread is consider to be hijacked!

I am also seeing another issue from my logs which i will create another post for.

jk

[jefft@iri.columbia.edu]

I'm also experiencing this ever since I upgraded to 7.1.1

Each morning at around 1:15am, I see a huge spike in my message count graph that jumps up to ~ 15-20,000 messages. The daily report shows a TOTAL of 10,000 messages received/delivered so I can't figure out why the graph is freaking out so much. Has anyone tracked down this problem yet?

Thanks

Jeff

[phoenix]

Originally Posted by jefft@iri.columbia.edu

Each morning at around 1:15am, I see a huge spike in my message count graph that jumps up to ~ 15-20,000 messages. The daily report shows a TOTAL of 10,000 messages received/delivered so I can't figure out why the graph is freaking out so much. Has anyone tracked down this problem yet?

Why don't you look in the log files at the specified time and see if there's any record of large numbers of email going through the system? You could also check to see if these messages are from any particular user.

[jefft@iri.columbia.edu]

Yes, I have done that and there is nothing noticeable. In fact, Zimbra's daily report shows this for the last 14 hours, but my message count graph shows that 19,000 emails supposedly were delivered between 1am and 2am.


Grand Totals
------------
messages

6185 received
6983 delivered
0 forwarded
22 deferred (252 deferrals)
909 bounced
0 rejected (0%)
0 reject warnings
0 held
0 discarded (0%)

524m bytes received
769m bytes delivered
964 senders
462 sending hosts/domains
434 recipients
109 recipient hosts/domains


Per-Hour Traffic Summary
time received delivered deferred bounced rejected
--------------------------------------------------------------------
0000-0100 264 237 17 63 0
0100-0200 351 330 13 61 0
0200-0300 253 229 11 60 0
0300-0400 321 377 16 60 0
0400-0500 477 468 21 65 0
0500-0600 344 331 20 62 0
0600-0700 279 276 15 65 0
0700-0800 343 335 20 61 0
0800-0900 402 393 18 63 0
0900-1000 452 465 14 63 0
1000-1100 586 697 21 63 0
1100-1200 659 718 23 62 0
1200-1300 550 671 21 62 0
1300-1400 590 881 16 69 0
1400-1500 314 575 6 30 0
1500-1600 0 0 0 0 0
1600-1700 0 0 0 0 0
1700-1800 0 0 0 0 0
1800-1900 0 0 0 0 0
1900-2000 0 0 0 0 0
2000-2100 0 0 0 0 0
2100-2200 0 0 0 0 0
2200-2300 0 0 0 0 0
2300-2400 0 0 0 0 0