Exim Usage is very high

[edica]

Exim Usage is very high. Why? What do I do?

In mainlog:

....
2015-05-27 15:45:56 1YxNMH-0003OM-ID Message is frozen
2015-05-27 15:45:56 1YxPCC-0000E8-Ve Message is frozen
2015-05-27 15:45:56 1YxOCg-0004tV-N7 Message is frozen
2015-05-27 15:45:56 1YxLxB-0001jI-8z Message is frozen
2015-05-27 15:45:56 1YxODr-0005EZ-E3 Message is frozen
2015-05-27 15:45:56 1YxOxG-0006pp-Tf Message is frozen
2015-05-27 15:45:56 1YxMZt-0002RO-K0 Message is frozen
2015-05-27 15:45:56 1YxP4O-0007H0-2q Message is frozen
2015-05-27 15:45:56 1YxPSU-0000td-LY Message is frozen
2015-05-27 15:45:56 1YxP16-0007DM-G3 Message is frozen
2015-05-27 15:45:56 1YxOAP-0004Ot-6a Message is frozen
2015-05-27 15:45:56 1YxOBy-0004aW-8e Message is frozen
2015-05-27 15:45:56 1YxOxH-0006qC-05 Message is frozen
2015-05-27 15:45:56 1YxOxC-0006m5-0T Message is frozen
2015-05-27 15:45:56 1YxOIG-0005OR-IE Message is frozen
2015-05-27 15:45:56 1YxNHR-0003IG-Lv Message is frozen
2015-05-27 15:45:56 1YxOJn-0005Ud-Qw Message is frozen
2015-05-27 15:45:56 1YxPCH-0000FW-3d Message is frozen
2015-05-27 15:45:56 1YxOvz-0006j6-4Q Message is frozen
2015-05-27 15:45:56 1YxLsL-0001eC-GI Message is frozen
2015-05-27 15:45:56 1YxMy5-0002tZ-7u Message is frozen
2015-05-27 15:45:56 1YxOEL-0005FR-RB Message is frozen
2015-05-27 15:45:56 1YxPCH-0000Ex-1J Message is frozen
2015-05-27 15:45:56 1YxP4O-0007Ge-0j Message is frozen
2015-05-27 15:45:56 1YxONk-0005mc-Uh Message is frozen
2015-05-27 15:45:56 1YxNHR-0003IS-Mu Message is frozen
2015-05-27 15:45:56 1YxOIL-0005Pu-SM Message is frozen
2015-05-27 15:45:56 1YxPEP-0000MW-Pd Message is frozen
2015-05-27 15:45:56 1YxOBR-0004T2-GZ Message is frozen
2015-05-27 15:45:56 1YxNyz-00046y-SU Message is frozen
....

[tjebbeke]

Run command:

Code: Select all

exim -bp

If it looks like below, it may be due to an error in a cron job or something.

31h 1.9K 1YxEWf-0006mr-Lv <> *** frozen ***
[email protected]

With this command, you can read the message body

Code: Select all

exim -Mvb HereMessageId

With this command, you can delete every message.

Code: Select all

exim -Mrm id

With this command, you delete the entire queue

Code: Select all

exim -bp | exiqgrep -i | xargs exim -Mrm

[edica]

Thanks it worked!

[lukeseven]

Hi, I am sorry to interrupt here but I am having kinda similar issue but after deleting entire queue it looks like all starts to be working,however, as soon as I see another bunch of frozen messages like ( Exim queue status 9m 1.6K 1aFqMg-00082H-2g <> *** frozen *** [email protected] ... most of the mails are not being delivered later. Now I removed whole queue and tested it. All seems to be working fine but I know I won't be receiving emails soon or later because there will be so many frozen messages like the one I mentioned above.

Can you please help me what else I could try if such issue recurs ?

Thank you

[tjebbeke]

Hi, I am sorry to interrupt here but I am having kinda similar issue but after deleting entire queue it looks like all starts to be working,however, as soon as I see another bunch of frozen messages like ( Exim queue status 9m 1.6K 1aFqMg-00082H-2g <> *** frozen *** [email protected] ... most of the mails are not being delivered later. Now I removed whole queue and tested it. All seems to be working fine but I know I won't be receiving emails soon or later because there will be so many frozen messages like the one I mentioned above.

Can you please help me what else I could try if such issue recurs ?

Thank you

Check the message header and body of the frozen messages.

[lukeseven]

Hi and thanks for almost immediate response.

It looks like it's being sent from the Cron Daemon. To be honest, I don't understand it much but now I am getting closer with this kind of info below. I have read some articles regarding exim's config and I have noticed that it says Debian-exim but I run my server on Ubuntu 14.04. I don't remember what the article stated exactly but I remember something about different configuration for different linux distribution.

And second of all I can see some php warnings at the bottom regarding NewRelic. I have always used NewRelic and I didn't have any troubles on the previous server running nearly the same set up I am running on my VPS now with exact same OS.

Below is the header and body of the latest frozen message :

root@5:~# exim -Mvh 1aGCNB-0004QE-Pc
1aGCNB-0004QE-Pc-H
Debian-exim 110 116
<>
1451941741 0
-ident Debian-exim
-received_protocol local
-body_linecount 28
-max_received_linelength 191
-allow_unqualified_recipient
-allow_unqualified_sender
-frozen 1451941741
-localerror
XX
1
root@5

145P Received: from Debian-exim by 5.***.***.*** with local (Exim 4.82)
id 1aGCNB-0004QE-Pc
for root@5.***.***.***; Mon, 04 Jan 2016 22:09:01 +0100
040 X-Failed-Recipients: root@5.***.***.***
029 Auto-Submitted: auto-replied
057F From: Mail Delivery System <Mailer-Daemon@5.***.***.***>
023T To: root@5.***.***.***
059 Subject: Mail delivery failed: returning message to sender
046I Message-Id: <E1aGCNB-0004QE-Pc@5.***.***.***>
038 Date: Mon, 04 Jan 2016 22:09:01 +0100

root@5:~# exim -Mvb 1aGCNB-0004QE-Pc
1aGCNB-0004QE-Pc-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

root@5.***.***.***
Unrouteable address

------ This is a copy of the message, including all the headers. ------

Return-path: <root@5.***.***.***>
Received: from root by 5.***.***.*** with local (Exim 4.82)
(envelope-from <root@5.***.***.***>)
id 1aGCNB-0004QA-Ob
for root@5.***.***.***; Mon, 04 Jan 2016 22:09:01 +0100
From: root@5.***.***.*** (Cron Daemon)
To: root@5.***.***.***
Subject: Cron <root@5> [ -x /usr/lib/php5/maxlifetime ] && [ -x /usr/lib/php5/sessionclean ] && [ -d /var/lib/php5 ] && /usr/lib/php5/sessionclean /var/lib/php5 $(/usr/lib/php5/maxlifetime)
Content-Type: text/plain; charset=ANSI_X3.4-1968
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1aGCNB-0004QA-Ob@5.***.***.***>
Date: Mon, 04 Jan 2016 22:09:01 +0100

PHP Warning: Module 'newrelic' already loaded in Unknown on line 0
PHP Warning: Module 'newrelic' already loaded in Unknown on line 0

I will appreciate any kind of suggestions here. Thank you

[tjebbeke]

Try to login as root and edit your cronjobs.
crontab -e
add at the end of each line: >/dev/null 2>&1
so the file looks like:
* * * * * here your job >/dev/null 2>&1

[lukeseven]

This is what I get when use this command ( crontab -e )

# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
#
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
#
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
#
# For more information see the manual pages of crontab(5) and cron(8)
#
# m h dom mon dow command
--------------------------------------------------------------------------------------------------------------------------------------------------

In VestaCP, I have not touch those 7 default cron jobs at all. Do I suppose to add this bit ( >/dev/null 2>&1 ) in VestaCP cron jobs?

Thank you for helping me to solve this issue.

[tjebbeke]

I think you need to look at this cron job: [ -x /usr/lib/php5/maxlifetime ] && [ -x /usr/lib/php5/sessionclean ] && [ -d /var/lib/php5 ] && /usr/lib/php5/sessionclean /var/lib/php5 $(/usr/lib/php5/maxlifetime)

[lukeseven]

Hi,

well, I found two files with no extension ( maxlifetime and sessionclean ).

This is the code of maxlifetime file below :

#!/bin/sh -e

max=1440

if which php5 >/dev/null 2>&1; then
for sapi in apache2 apache2filter cgi fpm; do
if [ -e /etc/php5/${sapi}/php.ini ]; then
cur=$(php5 -c /etc/php5/${sapi}/php.ini -d "error_reporting='~E_ALL'" -r 'print ini_get("session.gc_maxlifetime");')
[ -z "$cur" ] && cur=0
[ "$cur" -gt "$max" ] && max=$cur
fi
done
else
for ini in /etc/php5/*/php.ini /etc/php5/conf.d/*.ini; do
cur=$(sed -n -e 's/^[[:space:]]*session.gc_maxlifetime[[:space:]]*=[[:space:]]*\([0-9]\+\).*$/\1/p' $ini 2>/dev/null || true);
[ -z "$cur" ] && cur=0
[ "$cur" -gt "$max" ] && max=$cur
done
fi

echo $(($max/60))

exit 0


and this is the code of the second file sessionclean :

#!/bin/sh

# first find all used files and touch them (hope it's not massive amount of files)
[ -x /usr/bin/lsof ] && /usr/bin/lsof -w -l +d "${1}" | awk -- '{ if (NR > 1) { print $9; } }' | xargs -i touch -c {}

# find all files older then maxlifetime
find "${1}" -depth -mindepth 1 -maxdepth 1 -ignore_readdir_race -type f -cmin "+${2}" -delete



I have no idea where these files came from and if I can delete them or modify them and how.

Any idea ?

Thanks in advance and sorry for getting back that late. I've been very busy.

Cheers