I think you're right.. It's not a message in any particular mailbox. I think it's a network/connection issue. A kill command will usually work if we get it in quick enough. The log files show the 10054 and 10053 errors around the times that the service spikes.
The boxes are virus free and we abandoned port 80 back when code red was flying around. It's on the default 8383 now. It kind of builds up to eventually crashing, but it happens in the matter of a few minutes, not hours... I have diskeeper running on the boxes. I can't say that it keeps up, but it runs every night between 9PM and 8AM. Keep in mind that there are 7 servers I'm talking about here, not just 1.. So no hardware changes nor any significant software changes. No event logs so to speak.. Just the terminated unexpectedly errors from when we issue the kill command. Thanks for all the ideas, Shad D. Pulley Sr. Systems Engineer IKANO Communications [EMAIL PROTECTED] 801-415-8023 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Daniel Donnelly Sent: Wednesday, September 03, 2003 1:46 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Mail servers unite and crash just before the holiday weekend!!! I think you and Len are going down the wrong path. If iwebmsg.exe is showing high CPU, does a stop/start of the service 'fix' things (at least for a little while)? If it does, that is good, and the logs may tell us what is happening. With the W2*.log files and the computer time when CPU starting going high, the timestamped logs can show connections and actions requested and taken and with a few samples, you may even spot a trend/cause. By any chance is your Web Messaging running on port 80? If so, it could be under attack. I think it was Nimbda, and Code Red, a while back that gave these symptoms. Maybe other forms of attacks could show them, too. If I remember, W2 logs showed unusual requests for system folders/files... Someone else here in the forum also reported that not using port 80 helped them on some other Web MSG issues... Are you seeing increasing resource usage over time, by iwebmsg? Does it all free up when you stop/start the service? Has the hard drive (storing the users folders) been recently defragged? If not, it cannot hurt and may have significant positive effects. Has anything new been added to the computer or has any change been made in its configuration, recently? Checked for virus/Trojans/worms on the system? Maybe something got in that you have not yet detected? Have you checked Event logs? Any errors and warnings should be rectified, ASAP. Especially, if they begin to appear around the same time of this IMail problem. HTH, Dan Donnelly ----- Original Message ----- From: "Shad Pulley" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, September 02, 2003 3:18 PM Subject: RE: [IMail Forum] Mail servers unite and crash just before the holiday weekend!!! So, we dealt with it all weekend.. Just had the weekend crew babysit.. It's still happening.. Called IPSwitch this morning.. They used the typical 'it's your NIC' excuse.. Never mind these servers have been running fine for 2 years.. They suggested an upgrade to 8.. Took the chance and still no dice.. After an hour or so, IWEBMSG is still jumping up to 99% CPU usage and bringing the boxes to their collective knees. So say that it is some message in a mailbox that is making the service spike like that.. How do I go about tracking down that message? Thanks, Shad D. Pulley Sr. Systems Engineer IKANO Communications [EMAIL PROTECTED] 801-415-8023 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Len Conrad Sent: Friday, August 29, 2003 5:05 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Mail servers unite and crash just before the holiday weekend!!! >7 is susceptible, 8 is immune > >Some kind of "poisonous" spam message, a bad msg txt format or >attachment, getting through to probably many mailboxes on each server, >which when read from the queue or from the mailboxes cause the smtp queue >reader or iwebmsg to go get sick? > >when the machine locks up, or coming up to that point, is disk i/o excessive? key question: is it something msg coming in through SMTP to the queue + mailboxes, or is something hitting the HTTP port? Is the iwebmsg croaking because of something on HTTP or because of something being read from the mailboxes? Len _____________________________________________________________________ http://MenAndMice.com/DNS-training: London; San Jose; Wash DC IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, free To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
