I didn't know it was 7 servers. Are they all on the same hb/switch? Maybe the router is failing. I had this happen with just one IMail server before and the problem ended up being my firewall. The NIC going to the DMZ was bad and all I had in the DMZ was the IMail server.
---------- Original Message ---------------------------------- From: "Michael Thomas" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 3 Sep 2003 17:02:35 -0400 >Shad, > >I know I am responding in the middle of this. If someone has pointed out >these links or if you have performed the registry settings on the following >pages, please excuse me for coming in late. If you have not performed the >registry settings, your machines are at risk for denial of service attacks. > >It says it is for Win2003, used to say for .NET, and before that Win2K. >See: >http://support.microsoft.com/default.aspx?scid=KB;en-us;324270&; > >See this section on the page: TCP/IP Registry Values That Harden the TCP/IP >Stack >http://support.microsoft.com/default.aspx?scid=KB;en-us;324270 > >Mike > > >----- Original Message ----- >From: "Shad Pulley" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Wednesday, September 03, 2003 4:19 PM >Subject: RE: [IMail Forum] Mail servers unite and crash just before the >holiday weekend!!! > > >> I think you're right.. It's not a message in any particular mailbox. I >> think it's a network/connection issue. A kill command will usually work >if >> we get it in quick enough. The log files show the 10054 and 10053 errors >> around the times that the service spikes. >> >> The boxes are virus free and we abandoned port 80 back when code red was >> flying around. It's on the default 8383 now. It kind of builds up to >> eventually crashing, but it happens in the matter of a few minutes, not >> hours... I have diskeeper running on the boxes. I can't say that it >keeps >> up, but it runs every night between 9PM and 8AM. >> >> >> Keep in mind that there are 7 servers I'm talking about here, not just 1.. >> So no hardware changes nor any significant software changes. No event >logs >> so to speak.. Just the terminated unexpectedly errors from when we issue >> the kill command. >> >> Thanks for all the ideas, >> >> Shad D. Pulley >> Sr. Systems Engineer >> IKANO Communications >> [EMAIL PROTECTED] >> 801-415-8023 >> >> -----Original Message----- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] On Behalf Of Daniel Donnelly >> Sent: Wednesday, September 03, 2003 1:46 PM >> To: [EMAIL PROTECTED] >> Subject: Re: [IMail Forum] Mail servers unite and crash just before the >> holiday weekend!!! >> >> I think you and Len are going down the wrong path. >> >> If iwebmsg.exe is showing high CPU, does a stop/start of the service >> 'fix' things (at least for a little while)? If it does, that is good, >> and the logs may tell us what is happening. With the W2*.log files and >> the computer time when CPU starting going high, the timestamped logs >> can show connections and actions requested and taken and with a few >> samples, you may even spot a trend/cause. >> >> By any chance is your Web Messaging running on port 80? If so, it >> could be under attack. I think it was Nimbda, and Code Red, a while >> back that gave these symptoms. Maybe other forms of attacks could show >> them, too. If I remember, W2 logs showed unusual requests for system >> folders/files... Someone else here in the forum also reported that not >> using port 80 helped them on some other Web MSG issues... >> >> Are you seeing increasing resource usage over time, by iwebmsg? Does >> it all free up when you stop/start the service? >> >> Has the hard drive (storing the users folders) been recently >> defragged? If not, it cannot hurt and may have significant positive >> effects. >> >> Has anything new been added to the computer or has any change been >> made in its configuration, recently? Checked for virus/Trojans/worms >> on the system? Maybe something got in that you have not yet detected? >> >> Have you checked Event logs? Any errors and warnings should be >> rectified, ASAP. Especially, if they begin to appear around the same >> time of this IMail problem. >> >> HTH, >> Dan Donnelly >> >> ----- Original Message ----- >> From: "Shad Pulley" <[EMAIL PROTECTED]> >> To: <[EMAIL PROTECTED]> >> Sent: Tuesday, September 02, 2003 3:18 PM >> Subject: RE: [IMail Forum] Mail servers unite and crash just before >> the holiday weekend!!! >> >> >> So, we dealt with it all weekend.. Just had the weekend crew >> babysit.. >> It's still happening.. Called IPSwitch this morning.. They used the >> typical 'it's your NIC' excuse.. Never mind these servers have been >> running >> fine for 2 years.. They suggested an upgrade to 8.. Took the chance >> and >> still no dice.. After an hour or so, IWEBMSG is still jumping up to >> 99% CPU >> usage and bringing the boxes to their collective knees. >> >> So say that it is some message in a mailbox that is making the service >> spike >> like that.. How do I go about tracking down that message? >> >> Thanks, >> >> Shad D. Pulley >> Sr. Systems Engineer >> IKANO Communications >> [EMAIL PROTECTED] >> 801-415-8023 >> >> -----Original Message----- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] On Behalf Of Len Conrad >> Sent: Friday, August 29, 2003 5:05 PM >> To: [EMAIL PROTECTED] >> Subject: Re: [IMail Forum] Mail servers unite and crash just before >> the >> holiday weekend!!! >> >> >> >7 is susceptible, 8 is immune >> > >> >Some kind of "poisonous" spam message, a bad msg txt format or >> >attachment, getting through to probably many mailboxes on each >> server, >> >which when read from the queue or from the mailboxes cause the smtp >> queue >> >reader or iwebmsg to go get sick? >> > >> >when the machine locks up, or coming up to that point, is disk i/o >> excessive? >> >> key question: is it something msg coming in through SMTP to the queue >> + >> mailboxes, or is something hitting the HTTP port? >> >> Is the iwebmsg croaking because of something on HTTP or because of >> something being read from the mailboxes? >> >> Len >> >> >> >> _____________________________________________________________________ >> http://MenAndMice.com/DNS-training: London; San Jose; Wash DC >> IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, >> free >> >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: >> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: >> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> >> >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >> >> > > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
