too many sendmail processes

[Craig Rants]

Why is stmp in your /etc/inetd.conf? Comment out that line and run inetd -c. See if that helps.

MC,
C

[Craig Rants]

Ok after looking at you message very closely I see someone is trying to use wrappers (tcpd) to filter smtp traffic. Good and Bad. If you want it wrapped, this is how it will act, if you want it to act normal, comment it out. I would say that unless you are a top secret facility with highly sensitive email... You probably don't need to have wrappers on smtp.

MC,
C

[Steven Gillard_2]

Its seems that your problem is simply that sendmail is trying to process too many messages. So either you have a huge backlog or there are just too many people trying to send mail through your server. Here is what I would do:

1. Stop sendmail. In your case this will involve commenting the smtp line out of inetd.conf and running inetd -c. Then you can either kill all the sendmail processes still running or let them finish. This will reduce the load and make troubleshooting easier.

2. Move everything in /var/spool/mqueue to another directory.

3. Restart sendmail by uncommenting the line in /etc/inetd.conf and running inetd -c. You're now only accepting new messages.

4. Monitor incoming mail for a bit with tail -f /var/adm/syslog/mail.log. Check for messages being deferred and also for mail from systems that you don't expect.

5. Examine the old queue with "sendmail -bp -O QueueDirectory=". Check for deferred messages and anything else out of the ordinary.

6. Once things are normal again, you can either slowly move the messages back into /var/spool/mqueue a few at a time (remember move the df and qf files together), or you can wait for a quiet time and run "sendmail -q -O QueueDirectory=" to process the old queue where it is.

Once you're at this point you should have a better idea about what is going wrong. It is possible that the system simply can't cope with the volume of mail that you're trying to pump through it. Its only a 712 workstation remember!

Good luck!
Steve

[Nivesh Patnaik]

Yup, we have tcp wrappers. I will try all your suggestions. Thanks for all your help. Happy holidays!

[Nivesh Patnaik]

I commented out the smtp line in /etc/inetd.conf and restarted the inetd daemon. I checked /var/mail and saw that none of the mail came in. Instead of killing all the waiting processes individually, I rebooted the server. Now, there is mail. There is only one sendmail process hanging, and the load has dropped to 1.08 from 99 at one point.
Super! Thanks to all for the assistance. I can at least log in and run commands on the system which seemed impossible earlier.

I'm curious, is there supposed to be a default smtp line in inetd.conf? Right now I have none since I commented out the smtp line that was spawning /usr/lbin/tcpd.

I figure, with the many e-mails coming in and all these tcpd daemons being spawned, the system must have been backlogged. I don't know if the old processes were being slowly executed and cleared as the new e-mails came in.

Any tips on where I can get more info on this tcpd daemon? Is it something that is suppied with HP-UX

[Craig Rants · Accepted solution]

smtp is not a default entry of inetd.conf. It usually is only entered when used by wrappers. Wrappers are not default on hp as well. Here is a description: http://www.sans.org/infosecFAQ/unix/TCP_wrappers2.htm

I would not run smtp through inetd, your configuration now should suffice.


HH,
C