Scalix Forums

Hello everyone.

I received a complaint today from a co-worker that she was unable to receive attachments from an outside party. After doing some investigation and looking at the bounce-backs the sender received, it seems there's a timeout problem, and I can't seem to isolate it, hence my post here. =)

Basically, I'm getting the following error in the maillog:


In looking through my logs, I've been seeing a lot of these from several different e-mail addresses.

If I had to guess, I would get a network problem, but for this one user, I have been sending e-mails back and forth without a problem and she claims the attachments are only ~20k. But, I was able to send her an attachment of 200k, which in a way rules out the network connectivity (depending on how they have their mail setup I guess).

So now I'm kind of leaning towards Sendmail, but I'm not sure. Anyone have any ideas?

I'm running Scalix 10.0.1 on RHEL 4.

Thanks in advance.

-Mike

Hi Mike,

Can you clear a couple of thngs up here? First, is your co-worker a Scalix user? Second, are you using SpamAssassin with the MAILFILTER=TRUE in your smtpd.cfg file? If both of those are true, can you enable the SMTP Relay log by adding:

DEBUG_LOG=TRUE

to your smtpd.cfg file and restarting the SMTP Relay by typing:

omoff -d0 -w smtpd
omon smtpd

Now, the next time you see something like this in your maillog, can you find the corresponding log entry in the /var/opt/scalix/tmp/smtpd.log file and post that data here?

Thanks,
Rachel

Hi Rachel,

ScalixSupport wrote:Can you clear a couple of thngs up here? First, is your co-worker a Scalix user?

Yes, the co-worker is a Scalix user on the same system.

ScalixSupport wrote:Second, are you using SpamAssassin with the MAILFILTER=TRUE in your smtpd.cfg file?

I don't have a MAILFILTER=TRUE, but I do have a SMTPFILTER=TRUE. Is that the same thing?

ScalixSupport wrote:If both of those are true, can you enable the SMTP Relay log by adding:

DEBUG_LOG=TRUE

I went ahead and did that. I'll have the outside user try and re-send the e-mail that was causing the problems and post what I find.

Thanks!

-Mike

Hi Rachel,

I received a response that the original person send an e-mail with 2 attachments to myself and the original recipient. In the tmp/smtpd.log, I did see everything go through correctly and that it was accepted for delivery. What I did then was grep the maillog for the message ID, and then grep again for the new message ID after the hand-off to the milter.

Here are the results:


The extremely odd thing is that what you see is all I can find in reference to that e-mail. I don't see anything in my Inbox and neither does the other recipient.

Am I missing something here?

Hi Mike,

So, you're seeing the message come into smtpd and it's handed off to sendmail, but you're never receiving it in Scalix? Did you rebuild your sendmail.cf file from the sendmail.mc file at some point? If so, you need to run "omsendin" to re-add the Scalix specific rules, then restart sendmail.

If that's not the case, can you run:

sendmail -bt
> 3,0 mike@domain.com

and post the results?

Thanks,
Rachel

ScalixSupport wrote:So, you're seeing the message come into smtpd and it's handed off to sendmail, but you're never receiving it in Scalix?

For the latest one the sender had sent, yes. For all the other ones, I was seeing the "collect: read timeout" errors. What is happening now seems to be a secondary problem that's occuring with this domain. What's odd is that from other accounts (ie. my yahoo, gmail, etc.) I can send attachments to my Scalix account without a problem.

Did you rebuild your sendmail.cf file from the sendmail.mc file at some point? If so, you need to run "omsendin" to re-add the Scalix specific rules, then restart sendmail.

Yes I had done that, and that's been taken care of. The last time I modified the sendmail.cf was a long time ago.

sendmail -bt
> 3,0 mike@domain.com

and post the results?

Well, since it's becoming more and more of a pain, I'll just leave my domain and e-mail (even though I really don't like doing so ;)



Going back to the original posting, I've since had several more "collect: read timeout" errors from that sender, but I can't find anything in the smtpd.log with that mail ID. I did a grep of 'collect' on the maillog and the newest lines are below.



So I do have a smtpd.log that captured these e-mails, but how do I find in the smtpd.log the corresponding transactions? I did a search for the time, ie. 14:46:40 and came up empty.

Thanks for the help.

-Mike

Hi Mike,

You should be able to search for:

hansen@mun.ca
Rockhurst4@ruceci.com
phansen@mun.ca

and so on. Once found, you can compare the time, to match up the messages.

Thanks,
Rachel

ScalixSupport wrote:and so on. Once found, you can compare the time, to match up the messages.

That's exactly the problem I'm having. For example, if I pick the odd e-mail of the bunch, ejgidzljni@ntli.net, and search for it, the time in the maillog was Aug 15 15:37:31. The time in the smtpd.log is 14:30:59, not even close. Plus, there is only one refence in the smtpd.log which *must* be the one in the maillog.

Here's the output from the smtpd.log for that e-mail address:


I'm seeing the time desparity for all of the messages I'm looking for in the smtpd.log and the maillog.

For the e-mail address Rockhurst4@ruceci.com at 14:55:34, there are 2 e-mails in the smtpd.log, here are the first two lines of each transaction.



So I'm wondering if the errors are not from the external side, but from the internal? Just grabbing at straws here ;)

Thanks,
Mike

Hi Mike,

The times not matching is very strange. I can see in your smtpd.log file that indeed the sendmail connection was made:


and in the received from header of that message:



it shows the time when the header was written. There does seem to be a bit of a latency there (~37 seconds), but let's not get defocused on that for now.

So, there should be a corresponding entry in the maillog file that shows that connection at 14:30:59.

A couple of things you can do. First, you might want to temporarily disable your amavis milter in sendmail just to see if that's introducing some type of problem. Second, you can enable extended sendmail logging by adding something like:



to your /etc/sysconfig/sendmail file, then restarting sendmail. That way you can see the entire message as it's received from sendmail, including subject lines and message ID's which will make it easier to match up what's being received by the SMTP Relay and sendmail.

Thanks,
Rachel