From: Charles Gregory (cgregoryhwcn.org)
Date: Mon Nov 28 2005 - 13:04:38 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello!

Re the hourly (:00: to :05:) bounces, what you might do is look for cron
jobs that run at the beginning of each hour, and see if any of them close
and re-open sockets or files. In particular, look for badly behaved
'update' utilities for any of your content filters.

I'm taking a wild guess that the lmtp client is getting 'killed' in a
fashion that fails to generate a proper error message, so the error logged
is whatever was in the buffer from a previous command.

- Charles

On Sat, 26 Nov 2005, Christian Theune wrote:
> Within the first 5 minutes of every hour, I get one or two bounces
> that should have been delivered normally. The error messages appear
> mailinglists indexed by google, but are several years old and don't
> refer to any solution that applies to me.
>
> Typical log entries for those mails look like this:
>
> Nov 26 07:01:42 uter postfix/lmtp[635]: 7A507294B:
> to=<ctheune+quarantineimap.whq.gocept.com>,
> orig_to=<admin+quarantinegocept.com>,
> relay=/var/imap/socket/lmtp[/var/imap/socket/lmtp], delay=0,
> status=bounced (host /var/imap/socket/lmtp[/var/imap/socket/lmtp]
> said: 354 go ahead (in reply to MAIL FROM command))
>
> Nov 26 07:00:49 uter postfix/lmtp[635]: 8CE1A294D:
> to=<cocoimap.whq.gocept.com>, orig_to=<ckgocept.com>,
> relay=/var/imap/socket/lmtp[/var/imap/socket/lmtp], delay=0,
> status=bounced (host /var/imap/socket/lmtp[/var/imap/socket/lmtp]
> said: 250 2.1.5 ok (in reply to DATA command))
>
> Nov 26 01:00:09 uter postfix/lmtp[8381]: 3AD5D294B:
> to=<ctheuneimap.whq.gocept.com>,
> orig_to=<ctheunebart.whq.gocept.com>,
> relay=/var/imap/socket/lmtp[/var/imap/socket/lmtp], delay=0,
> status=bounced (host /var/imap/socket/lmtp[/var/imap/socket/lmtp]
> said: 500 5.5.2 Syntax error (in reply to MAIL FROM command))
>
> Did you notice the three different replies from the LMTP server? I 'm
> not sure why the first two replies bounce at all, and I'm not sure why
> the last one occurs at all. Some older posting (2003) implied that the
> LMTP client was broken in a way that transfers a size parameter within
> the first FROM line and wasn't understood properly by cyrus ...
>
> Anyway. The most awkward parameter is still, that it only happens in
> the first five minutes of an hour ...
>
> Thanks for any tip where to continue looking for why this happens,
> Christian
>

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]