Nagios filling up /var/spool/mqueue

[disrael]

We had so much stuff in this folder that rm -f * didn't work. I ended up clearing it up. I also changed the permissions to 000 for it to stop generating stuff in this folder. We ended up using our corporate forwarded instead of the local smtp. Though after I changed the permissions back to default settings it started filling up the directory again, even after I changed it to forwarder. I had to change the permissions back to 000 and delete all the files in there again. Any feed back would be great, as right now if I change the permissions back it will fill up and bring Nagios down.

Thanks in advance,

Doron

[scottwilkerson]

Doron,

It would be a good idea to take a look at /var/log/maillog to see if you can see why the mail isn't being delivered.

Code: Select all

tail -f /var/log/maillog

[disrael]

Sep 13 20:30:40 usa0300lv725 sendmail[16733]: q8DKUeqj016733: to=[email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30232, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 13 20:30:40 usa0300lv725 sendmail[16738]: q8DKUeuG016738: from=nagios, size=305, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost

This is what I was getting before I 000 the permissions to stop it from filling up mqueue/

[lmiltchev]

Can you post the output of the following command?

Code: Select all

chkconfig --list | grep sendmail

[disrael]

tmproot@usa0300lv725>chkconfig --list | grep sendmail
sendmail 0:off 1:off 2:on 3:off 4:off 5:off 6:off

[lmiltchev]

Run:

Code: Select all

chkconfig --level 345 sendmail on
service sendmail restart

Hope this helps.

[disrael]

tmproot@usa0300lv725>chkconfig --list | grep sendmail
sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off

We are seeing a very slow filling up of /var, though it is there. I see about a few megabytes of usage increase every hour or so. We have about a week before it fills up again, though I would prefer that it not come to that. The ammount of space usage is a lot less of an increase than it was before. I am going to clear up some log files and other stuff to see how much space we can clear up. The issue might be some stuff left over from when it was not properly setup.

-Doron

[mguthrie]

I had something like this occur because of a bad host name on a large block of emails, so sendmail just kept trying to resend them and choking because it couldn't resolve the hostname. I noticed the issue from checking /var/spool/mail/root. Not sure if it relates to your issue but I thought I'd mention it.

[scottwilkerson]

What do you have as the "Send Mail From" address in
Admin -> Manage Email Settings

Also, do you have the hostname set on your server to something other than localhost or localhost.localdomain?

Code: Select all

echo $HOSTNAME

[disrael]

It looks like that fixed the issue with /var HDD sucking up a lot of space in a small time period.

tmproot@usa0300lv725>echo $HOSTNAME
usa0300lv725

Send Mail From: "Xerox Nagios Reporting <[email protected]>"

/var/log/maillog:

Code: Select all

Sep 25 10:55:13 usa0300lv725 sendmail[16102]: q8PAtDqT016102: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30276, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16107]: q8PAtDfJ016107: from=nagios, size=283, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16107]: q8PAtDfJ016107: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30283, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16112]: q8PAtDOs016112: from=nagios, size=277, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16112]: q8PAtDOs016112: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30277, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16117]: q8PAtD3x016117: from=nagios, size=279, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16117]: q8PAtD3x016117: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30279, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16122]: q8PAtDWV016122: from=nagios, size=285, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16122]: q8PAtDWV016122: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30285, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]

We only have 4GB on the /var partion. Should we increase the size?

I also see some other files in /var that are using a lot of space:
315M ./cache/logwatch/logwatch.5Q5lVTWc
318M ./cache/logwatch/logwatch.3LpNGQIK
9.6M ./cache/logwatch/logwatch.5DsZLmB6
38M ./cache/logwatch/logwatch.LraZud1c
11M ./cache/logwatch/logwatch.lt0QMKqP
212M ./cache/logwatch/logwatch.Jro9ZJYc
319M ./cache/logwatch/logwatch.qDswKRm6
66M ./tmp/yum-disrael--1vWWs/RHEL5-Server-WDC
66M ./tmp/yum-disrael--1vWWs

Can I delete any of these files?

Thanks again,

Doron