Re: [exim] Duplicate emails

Ian Eiloart wrote:
> Please keep the conversation on the list. I've partially obfuscated the
> email addresses in your log extract.
>
> --On 19 May 2009 15:20:23 -0500 schmerold2@??? wrote:
>
>> Guess new server is not going to help:
>> [root@mx0 ~]# grep 1M6Vfd-0000VR-Vl /var/log/exim/main.log
>> 2009-05-19 15:13:16 1M6Vfd-0000VR-Vl <=
>> ESC1102585670301_1102184301057_xxxx@???
>> H=ccm32.constantcontact.com [208.75.123.228] P=esmtp S=29124
>> id=1102585670301.1102184301057.xxxx.7.241610FF@scheduler
>> 2009-05-19 15:13:17 1M6Vfd-0000VR-Vl => xxxx@??? R=internal
>> T=remote_smtp H=mail.katy.com [216.86.147.164] X=TLSv1:AES256-SHA:256
>> 2009-05-19 15:13:17 1M6Vfd-0000VR-Vl Completed
>> [root@mx0 ~]#
>>
>> We are processing in under a minute.
>
> This log entry doesn't prove that. The first line was logged when you
> accepted the message. The question is, what was the period from their
> making a connection to that point. To get that, you need to make your
> logging more verbose. Check the documentation for log_selector (section
> 49.15 Reducing or increasing what is logged).
>
> You probably want to add some of these: smtp_connection
> smtp_incomplete_transaction smtp_no_mail smtp_protocol_error
> smtp_syntax_error ident_timeout
>

Unless 'partially obfuscated' changed more than I think it did, roughly
one-second processing is within reach on that one, as it is a known spam engine:

2009-05-17 14:56:56 [13605] SMTP connection from [63.251.135.75]:8750
I=[203.194.153.81]:25 (TCP/IP connection count = 1)

2009-05-17 14:56:57 [50526] H=ccm00.constantcontact.com [63.251.135.75]:8750
I=[203.194.153.81]:25 rejected connection in "connect" ACL: C9
ccm00.constantcontact.com Locally blacklisted.

The match was on:

*.constantcontact.com

Which raises the question - how much of the problem the OP reports is driven by
a server spending more time than it needs to anal-izing spam that could have
been rejected early on smell alone?

Bill


>
>
>> I am not sure best way to get a reliable mean, median, mode
>>
>>

eximstats ---help



>>
>>
>> Ian Eiloart wrote:
>>>
>>> --On 18 May 2009 12:32:30 -0500 schmerold2@??? wrote:
>>>
>>>> It does seem like we are going to need to beef up the Exim hardware and
>>>> perhaps go to local RBL.
>>> Really? Check your logs to see if you can work out how long you're
>>> taking to return OK. If it's less than five minutes, then this (a) isn't
>>> your problem, and (b) is probably defending you from quite a lot of spam.
>>>
>>>> Lena@??? wrote:
>>>>>> From: schmerold2@gmail
>>>>>> We are getting duplicate emails. It seems to be the same senders,
>>>>>> however not every one of their emails duplicate. 5% of mails from
>>>>>> Charter.net will duplicate, 10% of mails from Cox will duplicate, 100%
>>>>>> of mails from Interfax.net will duplicate.
>>>>>> spamd_address = 127.0.0.1 783
>>>>> I guess that your spam-filter queries some RBL, and one or more of them
>>>>> timeout because dead or for paying customers only.
>>>>> Try switch spam-filtering via spamd off temporarily.
>>>>> If that doesn't help then try to switch virus-filtering off
>>>>> temporarily.
>>>
>>>
>
>
>