Shad, I know I am responding in the middle of this. If someone has pointed out these links or if you have performed the registry settings on the following pages, please excuse me for coming in late. If you have not performed the registry settings, your machines are at risk for denial of service attacks.
It says it is for Win2003, used to say for .NET, and before that Win2K. See: http://support.microsoft.com/default.aspx?scid=KB;en-us;324270&; See this section on the page: TCP/IP Registry Values That Harden the TCP/IP Stack http://support.microsoft.com/default.aspx?scid=KB;en-us;324270 Mike ----- Original Message ----- From: "Shad Pulley" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, September 03, 2003 4:19 PM Subject: RE: [IMail Forum] Mail servers unite and crash just before the holiday weekend!!! > I think you're right.. It's not a message in any particular mailbox. I > think it's a network/connection issue. A kill command will usually work if > we get it in quick enough. The log files show the 10054 and 10053 errors > around the times that the service spikes. > > The boxes are virus free and we abandoned port 80 back when code red was > flying around. It's on the default 8383 now. It kind of builds up to > eventually crashing, but it happens in the matter of a few minutes, not > hours... I have diskeeper running on the boxes. I can't say that it keeps > up, but it runs every night between 9PM and 8AM. > > > Keep in mind that there are 7 servers I'm talking about here, not just 1.. > So no hardware changes nor any significant software changes. No event logs > so to speak.. Just the terminated unexpectedly errors from when we issue > the kill command. > > Thanks for all the ideas, > > Shad D. Pulley > Sr. Systems Engineer > IKANO Communications > [EMAIL PROTECTED] > 801-415-8023 > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Daniel Donnelly > Sent: Wednesday, September 03, 2003 1:46 PM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Mail servers unite and crash just before the > holiday weekend!!! > > I think you and Len are going down the wrong path. > > If iwebmsg.exe is showing high CPU, does a stop/start of the service > 'fix' things (at least for a little while)? If it does, that is good, > and the logs may tell us what is happening. With the W2*.log files and > the computer time when CPU starting going high, the timestamped logs > can show connections and actions requested and taken and with a few > samples, you may even spot a trend/cause. > > By any chance is your Web Messaging running on port 80? If so, it > could be under attack. I think it was Nimbda, and Code Red, a while > back that gave these symptoms. Maybe other forms of attacks could show > them, too. If I remember, W2 logs showed unusual requests for system > folders/files... Someone else here in the forum also reported that not > using port 80 helped them on some other Web MSG issues... > > Are you seeing increasing resource usage over time, by iwebmsg? Does > it all free up when you stop/start the service? > > Has the hard drive (storing the users folders) been recently > defragged? If not, it cannot hurt and may have significant positive > effects. > > Has anything new been added to the computer or has any change been > made in its configuration, recently? Checked for virus/Trojans/worms > on the system? Maybe something got in that you have not yet detected? > > Have you checked Event logs? Any errors and warnings should be > rectified, ASAP. Especially, if they begin to appear around the same > time of this IMail problem. > > HTH, > Dan Donnelly > > ----- Original Message ----- > From: "Shad Pulley" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Tuesday, September 02, 2003 3:18 PM > Subject: RE: [IMail Forum] Mail servers unite and crash just before > the holiday weekend!!! > > > So, we dealt with it all weekend.. Just had the weekend crew > babysit.. > It's still happening.. Called IPSwitch this morning.. They used the > typical 'it's your NIC' excuse.. Never mind these servers have been > running > fine for 2 years.. They suggested an upgrade to 8.. Took the chance > and > still no dice.. After an hour or so, IWEBMSG is still jumping up to > 99% CPU > usage and bringing the boxes to their collective knees. > > So say that it is some message in a mailbox that is making the service > spike > like that.. How do I go about tracking down that message? > > Thanks, > > Shad D. Pulley > Sr. Systems Engineer > IKANO Communications > [EMAIL PROTECTED] > 801-415-8023 > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Len Conrad > Sent: Friday, August 29, 2003 5:05 PM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Mail servers unite and crash just before > the > holiday weekend!!! > > > >7 is susceptible, 8 is immune > > > >Some kind of "poisonous" spam message, a bad msg txt format or > >attachment, getting through to probably many mailboxes on each > server, > >which when read from the queue or from the mailboxes cause the smtp > queue > >reader or iwebmsg to go get sick? > > > >when the machine locks up, or coming up to that point, is disk i/o > excessive? > > key question: is it something msg coming in through SMTP to the queue > + > mailboxes, or is something hitting the HTTP port? > > Is the iwebmsg croaking because of something on HTTP or because of > something being read from the mailboxes? > > Len > > > > _____________________________________________________________________ > http://MenAndMice.com/DNS-training: London; San Jose; Wash DC > IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, > free > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
