[Mailman-Users] basic but serious spam question

[Mark Sapiro]

Juan Miscaro wrote:
>
>There must be some other mechanism at play here because there was very
>little of the heldmsg-* files.  However, when I discarded them
>(bin/discard) and restarted qrunner again I (postfix) am swamped with
>messages.


I suspect that you had a lot of messages queued in the 'virgin', 'in'
or 'out' queue and the corresponding qrunner wasn't running.


>I am looking in (for OpenBSD) /var/spool/mailman and I see
>some large directories:
>
>
>$ du -sh *
>
>199M    archives
>172K    data
>18.6M   lists
>2.0K    locks
>64.6M   logs
>38.3M   qfiles
>2.0K    spam
>
>
>$ du -sh logs/*  
>
>4.3M    logs/bounce
>240K    logs/error
>30.0K   logs/locks
>12.0K   logs/mischief
>320K    logs/post
>138K    logs/qrunner
>6.2M    logs/smtp
>52.5M   logs/smtp-failure
>864K    logs/subscribe
>38.0K   logs/vette


It looks like you have lots of log entries. Do you rotate your logs?


>$ du -sh qfiles/*
>
>2.0K    qfiles/archive
>48.0K   qfiles/bounces
>2.0K    qfiles/commands
>238K    qfiles/in
>2.0K    qfiles/news
>2.0M    qfiles/out
>2.0K    qfiles/retry
>24.3M   qfiles/shunt
>11.7M   qfiles/virgin


These big qfiles entries can be either a very large directory itself or
lots of stuff in the directory or both. Large directories result from
the corresponding runner not running and many messages piling up in
the queue. Once the runner starts, the messages are processed and
removed, but the directory itself never shrinks unless you do it
manually.

The shunt queue doesn't have a runner. Messages that encounter
unanticipated processing exceptions are placed in the shunt queue, and
the exception is logged in the error log. It is up to you to fix the
problem and delete the shunt queue entry or reprocess the shunted
messages with bin/unshunt.

-- 
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan