Hello,

We are a small ISP, few days ago one of our susbscriber decided to send
mass emails in thousands... that caused our email server to fail.
I resolved it by flushing the queue.. (atleast tried to resolve it)
"postfix flush". But the emails still kept on queueing.

After informing all or susbscribers, we thought that the only way would
be to cleanup the entire queue. So I tried "postsuper -d ALL". it did
delete some tens of thousands of messages.

Now, the problem is that we are still be bombarded.

Here is an excerpt from the log. I have changed the email addresses..

May 2 07:28:47 mta postfix/smtp[1127]: E5450E3E4: to=<tangronalde @
etang.mail.co.uk>, relay=localhost[127.0.0.1], delay=2, status=sent
(250 2.6.0 Ok, id=31752-02, from MTA: 250 Ok: queued as F370BE3E8)
May 2 07:28:47 mta postfix/smtp[1127]: E5450E3E4: to=<xiastevea @
etang.mail.co.uk>, relay=localhost[127.0.0.1], delay=2, status=sent
(250 2.6.0 Ok, id=31752-02, from MTA: 250 Ok: queued as F370BE3E8)
May 2 07:28:47 mta postfix/smtp[1127]: E5450E3E4: to=<nzfga_106 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=2,
status=sent (250 2.6.0 Ok, id=31752-02, from MTA: 250 Ok: queued as
F370BE3E8)
May 2 07:28:47 mta postfix/smtp[1127]: E5450E3E4:
to=<pierangelo.tomassetti994 @ jackson-hertogs.mail.co.uk>,
relay=localhost[127.0.0.1], delay=2, status=sent (250 2.6.0 Ok,
id=31752-02, from MTA: 250 Ok: queued as F370BE3E8)
May 2 07:28:47 mta postfix/smtp[1127]: E5450E3E4: to=<rnbeeman_154 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=2,
status=sent (250 2.6.0 Ok, id=31752-02, from MTA: 250 Ok: queued as
F370BE3E8)
May 2 07:28:47 mta postfix/smtp[1127]: E5450E3E4: to=<silver765836 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=2,
status=sent (250 2.6.0 Ok, id=31752-02, from MTA: 250 Ok: queued as
F370BE3E8)
May 2 07:28:47 mta postfix/qmgr[1122]: E5450E3E4: removed
May 2 07:28:47 mta postfix/smtpd[1123]: A6146E3E4:
client=unknown[172.26.5.38]
May 2 07:28:47 mta postfix/smtp[1145]: F370BE3E8: to=<nzfga_106 @
jackson-hertogs.mail.co.uk>,
relay=jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10],
delay=1, status=bounced (host
jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10] said: 550
5.1.1 User unknown (in reply to RCPT TO command))
May 2 07:28:48 mta postfix/cleanup[972]: A6146E3E4:
message-id=<007e01c66de4$b9c93460$c53695dd @ jadbe>
May 2 07:28:48 mta postfix/qmgr[1122]: A6146E3E4: from=<Jamie @
clockwatchers.mail.co.uk>, size=2175, nrcpt=8 (queue active)
May 2 07:28:48 mta amavis[31802]: (31802-03) ESMTP::10024
/var/amavisd/amavis-20060502T072843-31802: <Jamie @
clockwatchers.mail.co.uk> -> <abrams @
jackson-hertogs.mail.co.uk>,<rcarter1999419 @
jackson-hertogs.mail.co.uk>,<rk.ravcliffe_948 @
jackson-hertogs.mail.co.uk>,<rmschneider417 @
jackson-hertogs.mail.co.uk>,<rsbb_498 @
jackson-hertogs.mail.co.uk>,<sally879.603 @
jackson-hertogs.mail.co.uk>,<seattle49.68 @
jackson-hertogs.mail.co.uk>,<sfcolle258 @ jackson-hertogs.mail.co.uk>
Received: SIZE=2175 from mymta.mysite.mail.co.uk ([127.0.0.1]) by
localhost (mymta.mysite.mail.co.uk [127.0.0.1]) (amavisd-new, port
10024) with ESMTP id 31802-03; Tue, 2 May 2006 07:28:48 -0400 (EDT)
May 2 07:28:48 mta amavis[31802]: (31802-03) Checking: <Jamie @
clockwatchers.mail.co.uk> -> <abrams @
jackson-hertogs.mail.co.uk>,<rcarter1999419 @
jackson-hertogs.mail.co.uk>,<rk.ravcliffe_948 @
jackson-hertogs.mail.co.uk>,<rmschneider417 @
jackson-hertogs.mail.co.uk>,<rsbb_498 @
jackson-hertogs.mail.co.uk>,<sally879.603 @
jackson-hertogs.mail.co.uk>,<seattle49.68 @
jackson-hertogs.mail.co.uk>,<sfcolle258 @ jackson-hertogs.mail.co.uk>
May 2 07:28:48 mta amavis[31802]: (31802-03) spam_scan: hits=3.621
tests=BAYES_44,FORGED_OUTLOOK_TAGS,HTML_20_30,HTML _MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI
May 2 07:28:48 mta amavis[31802]: (31802-03) FWD via SMTP:
[127.0.0.1]:10025 <Jamie @ clockwatchers.mail.co.uk> -> <abrams @
jackson-hertogs.mail.co.uk>,<rcarter1999419 @
jackson-hertogs.mail.co.uk>,<rk.ravcliffe_948 @
jackson-hertogs.mail.co.uk>,<rmschneider417 @
jackson-hertogs.mail.co.uk>,<rsbb_498 @
jackson-hertogs.mail.co.uk>,<sally879.603 @
jackson-hertogs.mail.co.uk>,<seattle49.68 @
jackson-hertogs.mail.co.uk>,<sfcolle258 @ jackson-hertogs.mail.co.uk>
May 2 07:28:48 mta postfix/smtpd[1134]: connect from
mymta.mysite.mail.co.uk[127.0.0.1]
May 2 07:28:48 mta postfix/smtpd[1134]: C45B4E3E9:
client=mymta.mysite.mail.co.uk[127.0.0.1]
May 2 07:28:48 mta postfix/cleanup[920]: C45B4E3E9:
message-id=<007e01c66de4$b9c93460$c53695dd @ jadbe>
May 2 07:28:48 mta postfix/qmgr[1122]: C45B4E3E9: from=<Jamie @
clockwatchers.mail.co.uk>, size=2496, nrcpt=8 (queue active)
May 2 07:28:48 mta postfix/smtpd[1134]: disconnect from
mymta.mysite.mail.co.uk[127.0.0.1]
May 2 07:28:48 mta amavis[31802]: (31802-03) Passed, <Jamie @
clockwatchers.mail.co.uk> -> <abrams @
jackson-hertogs.mail.co.uk>,<rcarter1999419 @
jackson-hertogs.mail.co.uk>,<rk.ravcliffe_948 @
jackson-hertogs.mail.co.uk>,<rmschneider417 @
jackson-hertogs.mail.co.uk>,<rsbb_498 @
jackson-hertogs.mail.co.uk>,<sally879.603 @
jackson-hertogs.mail.co.uk>,<seattle49.68 @
jackson-hertogs.mail.co.uk>,<sfcolle258 @ jackson-hertogs.mail.co.uk>,
Message-ID: <007e01c66de4$b9c93460$c53695dd @ jadbe>, Hits: 3.621
May 2 07:28:48 mta amavis[31802]: (31802-03) TIMING [total 287 ms] -
SMTP EHLO: 1 (0%), SMTP pre-MAIL: 0 (0%), SMTP pre-DATA-flush: 3 (1%),
SMTP DATA: 39 (14%), body hash: 0 (0%), mime_decode: 15 (5%),
get-file-type: 36 (12%), get-file-type: 23 (8%), decompose_part: 4
(1%), decompose_part: 0 (0%), parts: 0 (0%), SA msg read: 6 (2%), SA
parse: 2 (1%), SA check: 86 (30%), fwd-connect: 10 (3%), fwd-mail-from:
1 (0%), fwd-rcpt-to: 10 (3%), write-header: 2 (1%), fwd-data: 0 (0%),
fwd-data-end: 43 (15%), fwd-rundown: 1 (0%), unlink-2-files: 4 (1%),
rundown: 1 (0%)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<abrams @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<rcarter1999419 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<rk.ravcliffe_948
@ jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<rmschneider417 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<rsbb_498 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<sally879.603 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<seattle49.68 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/smtp[1130]: A6146E3E4: to=<sfcolle258 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31802-03, from MTA: 250 Ok: queued as
C45B4E3E9)
May 2 07:28:48 mta postfix/qmgr[1122]: A6146E3E4: removed
May 2 07:28:48 mta postfix/smtp[1145]: F370BE3E8:
to=<pierangelo.tomassetti994 @ jackson-hertogs.mail.co.uk>,
relay=jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10],
delay=2, status=bounced (host
jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10] said: 550
5.1.1 User unknown (in reply to RCPT TO command))
May 2 07:28:49 mta postfix/smtpd[1123]: 76995E3E4:
client=unknown[172.26.5.38]
May 2 07:28:49 mta postfix/smtp[1149]: C45B4E3E9: to=<abrams @
jackson-hertogs.mail.co.uk>,
relay=jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10],
delay=1, status=bounced (host
jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10] said: 550
5.1.1 User unknown (in reply to RCPT TO command))
May 2 07:28:50 mta postfix/cleanup[972]: 76995E3E4:
message-id=<007f01c66de4$bad414b0$6811135f @ luow>
May 2 07:28:50 mta postfix/qmgr[1122]: 76995E3E4: from=<Neil @
clubplus.com>, size=2320, nrcpt=8 (queue active)
May 2 07:28:50 mta amavis[31752]: (31752-03) ESMTP::10024
/var/amavisd/amavis-20060502T072840-31752: <Neil @ clubplus.com> ->
<kimball @ jackson-hertogs.mail.co.uk>,<okean.485 @
jackson-hertogs.mail.co.uk>,<onemanspyder85 @
jackson-hertogs.mail.co.uk>,<rusba.843 @
jackson-hertogs.mail.co.uk>,<sebyers.917 @
jackson-hertogs.mail.co.uk>,<sensrock5.894 @
jackson-hertogs.mail.co.uk>,<snuttis_22_96 @
jackson-hertogs.mail.co.uk>,<womack @ jackson-hertogs.mail.co.uk>
Received: SIZE=2320 from mymta.mysite.mail.co.uk ([127.0.0.1]) by
localhost (mymta.mysite.mail.co.uk [127.0.0.1]) (amavisd-new, port
10024) with ESMTP id 31752-03; Tue, 2 May 2006 07:28:50 -0400 (EDT)
May 2 07:28:50 mta amavis[31752]: (31752-03) Checking: <Neil @
clubplus.com> -> <kimball @ jackson-hertogs.mail.co.uk>,<okean.485 @
jackson-hertogs.mail.co.uk>,<onemanspyder85 @
jackson-hertogs.mail.co.uk>,<rusba.843 @
jackson-hertogs.mail.co.uk>,<sebyers.917 @
jackson-hertogs.mail.co.uk>,<sensrock5.894 @
jackson-hertogs.mail.co.uk>,<snuttis_22_96 @
jackson-hertogs.mail.co.uk>,<womack @ jackson-hertogs.mail.co.uk>
May 2 07:28:50 mta amavis[31752]: (31752-03) spam_scan: hits=3.621
tests=BAYES_44,FORGED_OUTLOOK_TAGS,HTML_20_30,HTML _MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI
May 2 07:28:50 mta amavis[31752]: (31752-03) FWD via SMTP:
[127.0.0.1]:10025 <Neil @ clubplus.com> -> <kimball @
jackson-hertogs.mail.co.uk>,<okean.485 @
jackson-hertogs.mail.co.uk>,<onemanspyder85 @
jackson-hertogs.mail.co.uk>,<rusba.843 @
jackson-hertogs.mail.co.uk>,<sebyers.917 @
jackson-hertogs.mail.co.uk>,<sensrock5.894 @
jackson-hertogs.mail.co.uk>,<snuttis_22_96 @
jackson-hertogs.mail.co.uk>,<womack @ jackson-hertogs.mail.co.uk>
May 2 07:28:50 mta postfix/smtpd[1133]: connect from
mymta.mysite.mail.co.uk[127.0.0.1]
May 2 07:28:50 mta postfix/smtpd[1133]: 83489E3EA:
client=mymta.mysite.mail.co.uk[127.0.0.1]
May 2 07:28:50 mta postfix/smtp[1149]: C45B4E3E9: to=<rcarter1999419 @
jackson-hertogs.mail.co.uk>,
relay=jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10],
delay=2, status=bounced (host
jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10] said: 550
5.1.1 User unknown (in reply to RCPT TO command))
May 2 07:28:50 mta postfix/cleanup[920]: 83489E3EA:
message-id=<007f01c66de4$bad414b0$6811135f @ luow>
May 2 07:28:50 mta postfix/qmgr[1122]: 83489E3EA: from=<Neil @
clubplus.com>, size=2641, nrcpt=8 (queue active)
May 2 07:28:50 mta postfix/smtpd[1133]: disconnect from
mymta.mysite.mail.co.uk[127.0.0.1]
May 2 07:28:50 mta amavis[31752]: (31752-03) Passed, <Neil @
clubplus.com> -> <kimball @ jackson-hertogs.mail.co.uk>,<okean.485 @
jackson-hertogs.mail.co.uk>,<onemanspyder85 @
jackson-hertogs.mail.co.uk>,<rusba.843 @
jackson-hertogs.mail.co.uk>,<sebyers.917 @
jackson-hertogs.mail.co.uk>,<sensrock5.894 @
jackson-hertogs.mail.co.uk>,<snuttis_22_96 @
jackson-hertogs.mail.co.uk>,<womack @ jackson-hertogs.mail.co.uk>,
Message-ID: <007f01c66de4$bad414b0$6811135f @ luow>, Hits: 3.621
May 2 07:28:50 mta amavis[31752]: (31752-03) TIMING [total 279 ms] -
SMTP EHLO: 1 (0%), SMTP pre-MAIL: 0 (0%), SMTP pre-DATA-flush: 3 (1%),
SMTP DATA: 33 (12%), body hash: 1 (0%), mime_decode: 14 (5%),
get-file-type: 25 (9%), get-file-type: 22 (8%), decompose_part: 4 (1%),
decompose_part: 0 (0%), parts: 0 (0%), SA msg read: 6 (2%), SA parse: 3
(1%), SA check: 92 (33%), fwd-connect: 9 (3%), fwd-mail-from: 1 (0%),
fwd-rcpt-to: 10 (4%), write-header: 3 (1%), fwd-data: 0 (0%),
fwd-data-end: 47 (17%), fwd-rundown: 1 (0%), unlink-2-files: 4 (1%),
rundown: 1 (0%)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<kimball @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<okean.485 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<onemanspyder85 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<rusba.843 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<sebyers.917 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<sensrock5.894 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<snuttis_22_96 @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/smtp[1127]: 76995E3E4: to=<womack @
jackson-hertogs.mail.co.uk>, relay=localhost[127.0.0.1], delay=1,
status=sent (250 2.6.0 Ok, id=31752-03, from MTA: 250 Ok: queued as
83489E3EA)
May 2 07:28:50 mta postfix/qmgr[1122]: 76995E3E4: removed
May 2 07:28:51 mta postfix/smtp[1145]: F370BE3E8: to=<rnbeeman_154 @
jackson-hertogs.mail.co.uk>,
relay=jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10],
delay=5, status=bounced (host
jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10] said: 550
5.1.1 User unknown (in reply to RCPT TO command))
May 2 07:28:51 mta postfix/smtpd[1123]: 0E8DEE3E4:
client=unknown[172.26.5.38]
May 2 07:28:51 mta postfix/smtp[1152]: 83489E3EA: to=<kimball @
jackson-hertogs.mail.co.uk>,
relay=jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10],
delay=1, status=bounced (host
jackson-hertogs.mail.co.uk.s8a1.psmtp.mail.co.uk[64.18.7.10] said: 550
5.1.1 User unknown (in reply to RCPT TO command))
May 2 07:28:51 mta postfix/cleanup[972]: 0E8DEE3E4:
message-id=<008001c66de4$bbbb6770$d61d6860 @ MEOCBWS>


I do have following entries in main.cf

soft_bounce = no
bounce_queue_lifetime = 0
local_recipient_maps = proxy:unix:passwd.byname $alias_maps


Any ideas on how can i stop these message from being queued!

ALL is appreciated.

Thanks
With regards,

P

prabhdeep@gmail.com wrote:
> I tried "postsuper -d ALL". it did
> delete some tens of thousands of messages.

When using postsuper to requeue files or delete
all files, it's generally a good idea to first
stop Postfix, and then run the postsuper command.

Before restarting Postifx, you can verify that they
all got deleted with the "mailq" command.


> Now, the problem is that we are still be bombarded.

Anything that shows up in the queue after the "postsuper -d ALL"
is new email. If you want to stop that, then you will need to
identify something that's in common to use for blocking, typically
something like the sender's IP address, email address, subject line,
recipient addresses, etc.

Once you figure out what you need to block on, the list could
you out with information about configs that would do the blocking.

--
Greg