Too many mails in queue,in active directory!

[marisu]

environment: zcs509-OS . Redhat AS5
This morning , I found that there are too many mails in mail queue,most of them are in active directory. This caused that it would cost long time to send and receive mails ? some ideas?

[uxbod]

Have you checked your Log Files - Zimbra :: Wiki for any error messages especially /var/log/zimbra.log ?

[marisu]

Yes , I checked the log files, nothing unusual record in the files. All are common mail send and receive records. But i feel our server was attacked . Lots of mail address and domain name are not exist. It seems that they are combinated randomly by some legal characters. So our server got lots of bounced mails. This made the server very slowly and lots of mails still in queue quite a long time.
some ideas?

[uxbod]

Do a search for backscatter, and you can always read Improving Anti-spam system - Zimbra :: Wiki.

[marisu]

Our server is in dangerous now . It seems many and many mails are sent to queue. Lots of our users are complaint now. The reason of this situation is that lots of users , exist or non-exist ,send large numbers of mails to our server. it caused the server cannot process all of the mails quickly. My purpose is reject that non-exist mail addresses or the mails from non-exist domians. And if it can control that users which sent too many mails even better. This problem must be solved as quick as possible. I read the files which searched by backscatter ,but i still have no ideas. could you tell me which .cf file or files i could edit ? Thank a lot!!!

[uxbod]

Have you read Improving Anti-spam system - Zimbra :: Wiki ? especially the section on Simultaneous Connection Throttling as that will help the load on the server a bit. You may also want to check which RBLs you are using ?

su - zimbra
zmprov gacf | grep zimbraMtaRestriction

Have a read of AntiSpam aswell especially the final post by dwmtractor.

[marisu]

ok , i will read the two post now. and I upload my log files, can you check it and give me some information ? thanks a lot.

[uxbod]

I would certainly look at implementing Policyd or even PostGrey as that will get rid of a lot of bots.

[marisu]

I read and reread all of the documents you mentioned above. I also test my server as the document said. The result is that all the anti-spam and anti-virus works well . Until now I finally find the problem is that in the local domain, there are several users send lots of mails . And they are all common users,but have lots of business to do. Now the question is it seems that the active queue is a little lazy, or it processes the mails too slow . It cannot handle mails in time. I know some attributes such as queue_life_time , queue_run_delay , they can control how often the mails in queue will be resent. And my question is , does some attributes can control the active queue ? Or how can i make the active queue work in high efficiency ? thanks!