Nagios Support Forum

Support for Nagios products and services
https://support.nagios.com/forum/

Nagios filling up /var/spool/mqueue

https://support.nagios.com/forum/viewtopic.php?t=7407

Page 1 of 2

Nagios filling up /var/spool/mqueue

Posted: Mon Sep 17, 2012 8:55 am
by disrael
We had so much stuff in this folder that rm -f * didn't work. I ended up clearing it up. I also changed the permissions to 000 for it to stop generating stuff in this folder. We ended up using our corporate forwarded instead of the local smtp. Though after I changed the permissions back to default settings it started filling up the directory again, even after I changed it to forwarder. I had to change the permissions back to 000 and delete all the files in there again. Any feed back would be great, as right now if I change the permissions back it will fill up and bring Nagios down.

Thanks in advance,

Doron

Re: Nagios filling up /var/spool/mqueue

Posted: Mon Sep 17, 2012 9:42 am
by scottwilkerson
Doron,

It would be a good idea to take a look at /var/log/maillog to see if you can see why the mail isn't being delivered.

Code: Select all

tail -f /var/log/maillog

Re: Nagios filling up /var/spool/mqueue

Posted: Thu Sep 20, 2012 2:03 pm
by disrael
Sep 13 20:30:40 usa0300lv725 sendmail[16733]: q8DKUeqj016733: to=[email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30232, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 13 20:30:40 usa0300lv725 sendmail[16738]: q8DKUeuG016738: from=nagios, size=305, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost

This is what I was getting before I 000 the permissions to stop it from filling up mqueue/

Re: Nagios filling up /var/spool/mqueue

Posted: Thu Sep 20, 2012 4:22 pm
by lmiltchev
Can you post the output of the following command?

Code: Select all

chkconfig --list | grep sendmail

Re: Nagios filling up /var/spool/mqueue

Posted: Fri Sep 21, 2012 10:21 am
by disrael
tmproot@usa0300lv725>chkconfig --list | grep sendmail
sendmail 0:off 1:off 2:on 3:off 4:off 5:off 6:off

Re: Nagios filling up /var/spool/mqueue

Posted: Fri Sep 21, 2012 10:39 am
by lmiltchev
Run:

Code: Select all

chkconfig --level 345 sendmail on
service sendmail restart
Hope this helps.

Re: Nagios filling up /var/spool/mqueue

Posted: Tue Sep 25, 2012 9:32 am
by disrael
tmproot@usa0300lv725>chkconfig --list | grep sendmail
sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off

We are seeing a very slow filling up of /var, though it is there. I see about a few megabytes of usage increase every hour or so. We have about a week before it fills up again, though I would prefer that it not come to that. The ammount of space usage is a lot less of an increase than it was before. I am going to clear up some log files and other stuff to see how much space we can clear up. The issue might be some stuff left over from when it was not properly setup.

-Doron

Re: Nagios filling up /var/spool/mqueue

Posted: Tue Sep 25, 2012 9:47 am
by mguthrie
I had something like this occur because of a bad host name on a large block of emails, so sendmail just kept trying to resend them and choking because it couldn't resolve the hostname. I noticed the issue from checking /var/spool/mail/root. Not sure if it relates to your issue but I thought I'd mention it.

Re: Nagios filling up /var/spool/mqueue

Posted: Tue Sep 25, 2012 9:52 am
by scottwilkerson
What do you have as the "Send Mail From" address in
Admin -> Manage Email Settings

Also, do you have the hostname set on your server to something other than localhost or localhost.localdomain?

Code: Select all

echo $HOSTNAME

Re: Nagios filling up /var/spool/mqueue

Posted: Tue Sep 25, 2012 9:58 am
by disrael
It looks like that fixed the issue with /var HDD sucking up a lot of space in a small time period.

tmproot@usa0300lv725>echo $HOSTNAME
usa0300lv725

Send Mail From: "Xerox Nagios Reporting <[email protected]>"

/var/log/maillog:

Code: Select all

Sep 25 10:55:13 usa0300lv725 sendmail[16102]: q8PAtDqT016102: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30276, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16107]: q8PAtDfJ016107: from=nagios, size=283, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16107]: q8PAtDfJ016107: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30283, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16112]: q8PAtDOs016112: from=nagios, size=277, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16112]: q8PAtDOs016112: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30277, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16117]: q8PAtD3x016117: from=nagios, size=279, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16117]: q8PAtD3x016117: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30279, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 25 10:55:13 usa0300lv725 sendmail[16122]: q8PAtDWV016122: from=nagios, size=285, class=0, nrcpts=1, msgid=<[email protected]>, relay=nagios@localhost
Sep 25 10:55:13 usa0300lv725 sendmail[16122]: q8PAtDWV016122: [email protected], ctladdr=nagios (18256/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30285, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
We only have 4GB on the /var partion. Should we increase the size?

I also see some other files in /var that are using a lot of space:
315M ./cache/logwatch/logwatch.5Q5lVTWc
318M ./cache/logwatch/logwatch.3LpNGQIK
9.6M ./cache/logwatch/logwatch.5DsZLmB6
38M ./cache/logwatch/logwatch.LraZud1c
11M ./cache/logwatch/logwatch.lt0QMKqP
212M ./cache/logwatch/logwatch.Jro9ZJYc
319M ./cache/logwatch/logwatch.qDswKRm6
66M ./tmp/yum-disrael--1vWWs/RHEL5-Server-WDC
66M ./tmp/yum-disrael--1vWWs

Can I delete any of these files?

Thanks again,

Doron
All times are UTC-05:00
Page 1 of 2

Powered by phpBB® Forum Software © phpBB Limited