Problems with SMTP and Nagios

[Andreas Widerøe Andersen]

Thanks for your reply! Below are some comments/replies:

At 10:17 27.02.2003 +1100, Stanley Hopcroft wrote:
>Dear Sir,
>
>I am writing to thank you for your letter and provide a small amaount of
>nagtive assistance.
>
>On Wed, Feb 26, 2003 at 12:45:13PM +0100, Andreas Widerøe Andersen wrote:
> > Yesterday I built a new sendmail.cf file and added certain features 
> such as
> > spam blocking. I also got the .cf file upgraded to the latest v.8.12.7.
> > Since those upgrades/changes were made I'm getting PROBLEM-Notifications
> > from Nagios (via mail) like this:
> >
> > Subject: ** PROBLEM alert - Myserver/SMTP is CRITICAL **
> >
> > Notification Type: PROBLEM
> >
> > Service: SMTP
> > Host: Myserver
> > Address: XXX.XXX.XXX.XXX
> > State: CRITICAL
> >
> > Date/Time: Wed Feb 26 12:03:14 CET 2003
> >
> > Additional Info:
> >
> > Socket timeout after 10 seconds
> >
> > In the /var/log/maillog I see the following when Nagios is reporting 
> problems:
> >
> > Feb 26 12:19:22 myserver sendmail[53651]: h1QBI13F053651:
> > mynagios.domain.com [212.125.232.195] did not issue MAIL/EXPN/VRFY/ETRN
> > during connection to MTA
> >
>
>Similar environment here (FreeBSD 4.7-RELEASE + Sendmail 8.12.6) using
>check_smtp on the local (Nag host) MTA.
>
>The log entries above are normal senmail complaints about a connection
>that fails to transmit a message: they are not responsible for Sendmail
>refusing the connection (and they becoming from another process).
>
>eg
>
>tsitc> date
>Thu Feb 27 10:10:06 EST 2003
>
>tsitc> telnet localhost smtp
>Trying ::1...
>Trying 127.0.0.1...
>Connected to localhost.
>Escape character is '^]'.
>220 tsitc.aipo.gov.au ESMTP Sendmail 8.12.6/8.12.6; Thu, 27 Feb 2003
>10:10:14 +1100 (EST)
>quit
>221 2.0.0 tsitc.aipo.gov.au closing connection
>Connection closed by foreign host.
>
>tsitc> tail -1 /var/log/maillog
>Feb 27 10:10:16 tsitc sendmail[59632]: h1QNAEm3059632: localhost
>[127.0.0.1] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>tsitc> date
>Thu Feb 27 10:10:34 EST 2003
>tsitc>
>
>
> > Anyone seen this before and perhaps have a way to fix it?
> >
>
>I don't think there is any way to fix it apart from modifying sendmail
>to refrain from such logging.

Yes, I realized this just after posting this messsage. I did the exact same 
test as described above.

>To make some progress with the problem, you should
>
>1 Establish whether check_smtp works from the command line

Will do!

>2 Run the plugin on another host (so that you can trace the connection)
>and see why the problem host refused the connection.
>
>or truss the check_smtp process on the monitor host with truss -p ..
>
>Does the monitor host have a reverse DNS entry ?

Yes it does.

>Does it have to appear in some 'permitted to' list in Sendmail - such as
>accept relay from ?

It's in there.

The weird thing is  that it works 90-95% of the day. However a few times it 
starts "flapping" as reported by Nagios. While watching the log (tail -f 
/var/log/maillog) when it's flapping it works fine for all other mail 
coming through. I get 3 of these "did not issue MAIL/EXPN/VRFY/ETRN.." and 
then my beeper starts beeping and PROBLEM mails starts coming through.

The server has practically no load:

#uptime
9:28AM  up 36 days, 15:52, 2 users, load averages: 0.00, 0.01, 0.00

I've got the same problem with 2 servers running the same OS and same 
versions of software.

I'll keep looking. Thanks!

/Andreas


---
Andreas Widerøe Andersen <awand at pragma.no>
Pragma AS

http://www.pragma.no 



-------------------------------------------------------
This SF.net email is sponsored by: Scholarships for Techies!
Can't afford IT training? All 2003 ictp students receive scholarships.
Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more.
www.ictp.com/training/sourceforge.asp
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null