content filter attacked?

[ahhhh]

I submitted this problem to bugzilla.zimbra.com a few weeks ago, but had no responses, and this morning it happened again.

http://bugzilla.zimbra.com/show_bug.cgi?id=15240

I'm not completely sure that these two things are related, but when I started work on Monday morning, there were complaints of no email going through, so I checked the mail queues, and Zimbra had almost 4000 messages (which was probably most of the weekend's messages) in the deferred queue. I noticed that some of them didn't say the normal "smtp-amavis:[127.0.0.1]:10024" in the content filter field, but rather had content from the junk mail. Here's an image with the tooltip showing the garbage in the content filter field on the deferred tab: Exhibit A

I requeued the 3800 that were deferred due to "lost connection with 127.0.0.1", with the exception of the 80 or so of them that had strange looking Content Filter fields. None of these messages caused any further problems. I have kept the 80 "bad" messages in case someone would like to see them for further debugging. Here's an image with the tooltip showing a bunch of messages with garbage in the content filter field: Exhibit B

Since the problem started, I rebooted the machine. There haven't been any more mail problems that I know of, but I've noticed that the content filter field is is now blank on the deferred page (even for messages that were deferred after the reboot (and undefined in the tooltip) as seen in Exhibit C

I'm not any kind of linux expert, but if you need anything specific such as logs, I'll either get it or find someone here who can.

Thanks,

Ahmad van der Breggen
MarkeTel Systems

[keffa]

Originally Posted by ahhhh

I submitted this problem to bugzilla.zimbra.com a few weeks ago, but had no responses, and this morning it happened again.

http://bugzilla.zimbra.com/show_bug.cgi?id=15240

I'm not completely sure that these two things are related, but when I started work on Monday morning, there were complaints of no email going through, so I checked the mail queues, and Zimbra had almost 4000 messages (which was probably most of the weekend's messages) in the deferred queue. I noticed that some of them didn't say the normal "smtp-amavis:[127.0.0.1]:10024" in the content filter field, but rather had content from the junk mail. Here's an image with the tooltip showing the garbage in the content filter field on the deferred tab: Exhibit A

I requeued the 3800 that were deferred due to "lost connection with 127.0.0.1", with the exception of the 80 or so of them that had strange looking Content Filter fields. None of these messages caused any further problems. I have kept the 80 "bad" messages in case someone would like to see them for further debugging. Here's an image with the tooltip showing a bunch of messages with garbage in the content filter field: Exhibit B

Since the problem started, I rebooted the machine. There haven't been any more mail problems that I know of, but I've noticed that the content filter field is is now blank on the deferred page (even for messages that were deferred after the reboot (and undefined in the tooltip) as seen in Exhibit C

I'm not any kind of linux expert, but if you need anything specific such as logs, I'll either get it or find someone here who can.

Thanks,

Ahmad van der Breggen
MarkeTel Systems

A failure of the filter or overload possibly?

[AimanA]

My site just got clobbered with spam too... Maybe they are trying to make their end of month quota . I didn't experience any failure of the ZCS services. I will take a look through my logs to see if anything might have crapped that I missed.