Statistics wrong?

[lpmartineau]

Hi everyone,

I run a small personal email server using Zimbra and I noticed the stats are wrong as far as I know anyways.

for example the last 48 hours shows spikes of 30,000 messages.
and message volumes up into the 135,000,000 bytes.

I have a few domains and about half a dozen accounts, there is very little spam activity going and the server itself is just a dual core atom with 2GB of ram, I don't think it could handle 30,000 messages in a day

Any ideas?

I am using ZCS 6 on Debian 64 bit.

Thank you.

[fyd]

A quick thought, did you try a "su - zimbra; zmcontrol stop/start" to see if that could help?

[lpmartineau]

Hi Fyd,

Thanks for the reply.

Yes, I have a nightly backup that stops zimbra, does a lvm snapshot and then starts zimbra.

Have a great day.

[gdr777]

I see this same spiky behavior in my statistics. I have no idea where its coming from, I have reviewed various logs looking for activity during the time windows when spikes are reported to occur, but there is nothing in the logs. The spikes are orders of magnitude higher than normal activity. I logged a support request and they were never able to figure it out either.

[GreenGumby]

Same on my installation. I don't pay a whole lot of attention to it. The daily summary that gets emailed is accurate and far more useful.

[gdr777]

Yes, the daily reports are accurate, and are useful for daily detail, but are not useful for revealing any trends over time. The graphs _would_ be useful for visualizing trends if the erroneous spikes didn't exist. With the spiky behavior, the graphs are useless, because the spikes skew the data so severely. Visualizing trends through weeks/months would be useful for me. I'm not inclined to extract and recompile data from the daily emails... especially when the graphing function already exists, but is just not usable. I'd be curious to know if you are on debian(Ubuntu) 64bit, because the original poster mentioned he was, as am I (8.04 LTS). Perhaps this anomaly only exists on that platform for some reason...

[GreenGumby]

Running CentOS 6.latest 64-bit under vmware esxi 4

[liyaxin]

And mail volume is 135,000,000 bytes. I have a number of domains and half a dozen accounts, there is little spam activities, and the server itself is a 2GB of RAM, dual-core Atom, I do not think it can handle 30,000 messages a day, any ideas? I use the zero current in Debian 64-bit.

[kruon]

I think the statistics go wrong due to the log parsing method.

Lets look how mail traverses inside zimbra:
Inbound internet mail:
Mail arrives -> log
AV, Antispam queues -> log
Local delivery -> log

In/outbound internal mail
Local av loop -> log
Local delivery -> log

Outbound internet mail
Local av loop -> log
smtp delivery -> log


Stars mark log points

You can see the mail multiplying in statistics by factor of 2 or 3 per every mail, the count could be even more, maybe 3 for internal mail, 4 for internet.
So the totals count in statistics is wrong by factor of 2-4 and it's not easy to correct.
It would require rewrite on the report gathering side to fix it.

But it's not all that simple!

Another thing mixing statistics is nature of SMTP itself.
You can send email, but receiving server can request delay and retransmit(think postgrey).
This would log same message being sent again after few minutes, maybe even several times during same day before it was actually delivered.

[phoenix]

The 'problems' of counting mail traffic through an MTA are well known, the statistics produced by ZCS are based on an open source script called pfloggsumm. There's a section in the FAQ of the author's site about it: Pflogsumm Reports Double Traffic When Anti-Virus Scanner Used