Sendmail - a user getting hundreds of same message

[robin wells-meisner]

I cannot figure out why this is happening. We've had this a couple times and my fix is to destroy and re-create my Sendmail users' account. I'd sure like to know what this is though and how I can prevent it.
FYI, this has happened on Sendmail 8.9.3 and our current, 8.11.1. The HP-UX server is at 11.0.
A user will get hundreds and hundreds of repeat email messages. All the messages have the same date/time stamp and are identical.
Does anyone know how to fix/prevent this?
Thanks for your time and assistance!
Robin

[Rita C Workman]

Hi Robin,

That's not a whole lot of info to say what's happening....
Here are some ideas to check on and/or maybe you could post something more specific...

The first thing I might do is:
Check my syslog for anything strange.
Check my mail log for any clues.
Try and figure where is the message originating from? Does this give you any as to who or what is causing it?

Is the message possibly being triggered by an application that sends a report via sendmail/elm? -or- application sends message if job terminates improperly? Or possibly their program is poorly written and has gone into a loop...

Like I said, without some more info...it's hard to know...just some ideas to check..

Rgrds,
Rita

[someone_4]

WHOOO !!
I thought this was just me !!
This has happned to customers on my sendmail mailserver too!! I have actully tracked some down and here is what seems to be happening. The email is getting stuck on the mailserver from the incomming domain. FOr example mydomain.com and senderdomain.com .. the email to mydomain.com is actullly stuck in the mailserver of senderdomain.com. I have spoken to an admin and they see it "stuck" and resending over and over again. The clear it up and it stop sendinging. Now here are some extra details and thoughts about this issue.

1.I have tested it from a certain domain. But it is not domian specific it is random. If an email is stuck comming from user1@xyz.com .. it doesnt mean that user2@xyz.com will have the same problem. It is very hard to recreate.
2.If you check the mail file for the user that keeps getting the same email. The file clears out. And you can actully see the file fill up and the customer download email after email. This tells me that it is a "new message" comming in every time and the mailserver is doing what it knows to do. ANd that is send the message to the local user.
3.After a few hours it does clear its self out.
4.It is almost like mydomain.com is not sending some kind of disconnect signal to theirdomain.com. The best way I can describe it is that theirdomain.com tries to send an email to mydomain.com but it doesnt go tough for whatever reason (network or sendmail.cf related) and they get a connection can not be made message. And then it tries again. and again and again. BUt my domain.com doesnt tell theirdomain.com that the mail came though this time. Follow me?

Well thats all for now. But I have had this issue happend to me. over and over and over again.

Richard

[robin wells-meisner]

Yes, Richard. No I know we're not the only ones! Actually, the last one that happened I contacted their mail admin (a GroupWise email system) and the admin mentioned that this has happened to some of his users as well. I've not had much luck in contacting mail admins to clean this up, they state that they cannot see it.
I can definitely see the message in the mail.log file, but nothing in syslog.log. The message ID, date and time stamp are always identical.
If I get into the users mail file, then, of course I see the messages.
It is, as you say, like a connection that will not drop, or not be confirmed as done, and some kind of retry is happening.
The user has no .lock file during this process, or at least I can find no evidence that this is some type of mis-behaved file lock.
In fact, after I destroy and re-create the user account on my server, I will continue to see the message trying to deliver for some amount of time (which differs from instance to instance). BUT, the send cannot seem to find the new user (Different UID??)and so it fails and eventually stops.
I cannot imagine that this is 'coming from' the mail server on my side because Sendmail is in a listen state, not a 'go get it' state.
As I say, we're not alone, and I'm sure alot of admins would like to know a prevention, or at least a resolution. If anyone knows, please share.

[Rita C Workman]

I don't know if this will help..but it can't hurt.
It sounds to me as though one side or the other is not responding properly to standard SMTP protocol signals. You may want to review your /etc/mail/sendmail.cf and possibly this thread will help as well (it's a bit to read..but somewhat informative).
http://support.novell.com/cgi-bin/search/searchtid.cgi?/2929219.htm

Rgrds,
Rita

[robin wells-meisner]

I think I found it. For our site anyway.
It seems the folks at Listserv are familiar
with this as a known issue with Cisco's PIX
firewall:

http://www.lsoft.com/manuals/lsv-faq.stm#Cisco

Obviously, I'll be asking the firewall admin to look this over and make the fix.
I won't post here again unless something new/different on this issue comes up.
Have a great day!
Thanks for all the input
Robin