Delay in sendmail

[Steven Sameshima]

We have an rp8400 running HP-UX 11i that has always put a 2 minute 40 second delay when relaying mail. Note that we send email from this server to another HP-UX 11i server which then forwards the mail to an Exchange Server. I can't find anything in the sendmail.cf to indicate where the delay might be coming from. I even compared this sendmail.cf to another 11i server which relays its email in a similar manner but has no delays but found no differences. Can anybody point out what is creating the delay? The delay is visible in the mail.log file.

[Mic V.]

Can you post a sample from mail.log?

(Until I read your last sentence, I was going to ask if the servers were all time sync'ed, but I think you mean you can see it all happen on the rp8400.)

Is it showing up in the queue ("mailq") during the 2:40?

Is your sendmail fully patched?

Mic

[Tony Scully_2]

Steven,

What is generating the mail message, commnand line, mailx, elm, or an application?

Cheers,
T

[Steven Sameshima]

All,

Below is an excerpt from the mail.log. I had to sanitize it a little so the hostnames are really fully qualified and the IP address isn't really 1.2.3.4.

Mar 21 11:09:06 cadmla sendmail[7985]: LAA07985: from=oracle, size=2671, class=0, pri=32671, nrcpts=1,
msgid=<200503211109.LAA07985@cadmla.com>, relay=oracle@localhost
Mar 21 11:09:06 cadmla sendmail[7988]: LAA07988: from=oracle, size=244, class=0, pri=30244, nrcpts=1,
msgid=<200503211109.LAA07988@cadmla.com>,
relay=oracle@localhost
Mar 21 11:09:44 cadmla sendmail[7958]: LAA07949: to=acbonnemaison@something.com, ctladdr=dmloader (107/30),
delay=00:02:40, xdelay=00:02:40, mailer=relay, relay=bkupla.com [1.2.3.4], stat=Sent
(LAA07977 Message accepted for delivery)
Mar 21 11:09:44 cadmla sendmail[7960]: LAA07952: to=acbonnemaison@something.com, ctladdr=dmloader
(107/30), delay=00:02:40, xdelay=00:02:40, mailer=relay, relay=bkupla.com [1.2.3.4],
stat=Sent (LAA07978 Message accepted for delivery)

This excerpt shows 2 emails generated by mailx and sent by user oracle. Note the delay value of 2:40 in the lines where the email is accepted for delivery.

In general, we only patch as necessary. In the case of this server, we only have the 12/02 GoldApps and GoldBase bundles plus the 3/03 HW bundle. Note that we installed additional patches (none related to sendmail) to accomodate Oracle.

Steve

[Tony Scully_2]

Steven,

Very odd.

Does this happen with other users (not just oracle)? You mention that mail is routed to another HP box, which then relays this to exchange - is there anything 'unusual' about the sendmail daemon config on that HP box is there - its a very vague question I know!

Does mail for a local user get delivered without the delay?

[Steven Sameshima]

The delay occurs for every user. We don't actually send mail locally. All mail is routed to the applicable user's exchange account, even root.

[Mic V. · Accepted solution]

Thanks for the snippet. No problem about sanitization; it's sane in today's world.

I'm going to "talk" as I think ...everyone feel free to jump in.

I'm not an expert at sendmail logs, but bear with me -- this is an interesting learning experience.
This link describes sendmail's log format:

http://logreport.org/doc/gen/email/sendmail.php

and about "delay=" says:

The total message delay: the time difference between reception and final delivery or bounce). Format is delay=HH:MM::SS for a delay of less than one day and delay=days+HH:MM::SS otherwise.

Perhaps someone else has more insight into this, but to me this implies the amount of time it takes sendmail to deliver it; i.e., if the receiver is slow at accepting the message, the delay shows up in the "delay=" field. Does this work for anyone else? This would mean the 11i server between this host and the Exchange server is adding the delay. Or perhaps I'm reading it wrong and it really does imply a delay on the originating host.

More reading:
http://www.unix.org.ua/orelly/networking/sendmail/ch26_01.htm
http://docs.hp.com/en/B2355-90776/ch02s10.html

Let me propose a nomenclature for discussion: "A" is the host in question, "B" is the other, similar host, and "R" is the 11i server that relays to Excahnge.
Do A and B relay exactly the same (like, you could plug B into A's role)? If so, then my theory above is probably toast.

Are A and B on the same subnets? Same DNS config (resolv.conf, nsswitch.conf)? YP domain? I'm wondering if the delay is related to name resolution, but you'd think it would vary if that was the case.

Is there some networking-related patch difference between them?

What is the approximate load average on this host (A)?

It *would* be interesting to see if the delay happened with locally-delivered mail...

Mic

[Fred Ruffet]

Have you compared name resolution for your servers (in both ways) ? Such timing may come from a look into a bad DNS before hosts file. Compare /etc/hosts /etc/nsswitch.conf and /ec/resolv.conf.

Regards,

Fred

[Muthukumar_5]

I hope your hostname resolvation is getting delayed. Check the file as,

/etc/nsswitch.conf file for hosts: entry
/etc/hosts
/etc/resolve.conf

Use traceroute, nslookup commands and their timings. Post these information to help you more.

HTH.

[Steven Sameshima]

It was the /etc/nsswitch.conf that was causing the problem. For some reason, on this server, the "hosts" line had dns (which we don't use)and somehow, the server bypassed hosts and nis and tried to use dns to resolve the hostname of the server that email is forwarded to. Thanks to all who responded.