Palmer down 2

[porjo]

Once again, Palmer seems to have dropped off.

I was connecting to it pretty regularly this evening but just now it has started refusing connections to HTTP, FTP, IMAP.

I can ping it.

[Sam]

Back up again.

[porjo]

Back up...another reboot..sigh

21:25:34 up 4 min,

[Johnnod]

Server Load 11.84 (4 cpus)
Memory Used 89.4 %
Swap Used 15.08 %

not safe....

[AdamF]

Craig is going to have a look at it first thing tomorrow morning. Looks like a SPAM issue from someones site.

(When a spam issue occurs, the mail queue becomes clogged with crap, and as it re-trys to send it every hour, it gets a high load trying to send hundreds of bogus emails. Clearing the queue is a temporary fix, but more detailed log analysis is needed to find the site where it's coming from)

[Andrew G]

Craig is going to have a look at it first thing tomorrow morning. Looks like a SPAM issue from someones site.

(When a spam issue occurs, the mail queue becomes clogged with crap, and as it re-trys to send it every hour, it gets a high load trying to send hundreds of bogus emails. Clearing the queue is a temporary fix, but more detailed log analysis is needed to find the site where it's coming from)

I've never tried to do it, but couldn't you put something on the SMTP server that requires a username/password, and shares the same ones as cPanel, therefore it could only be your customers sending the spam on that server, you'd be able to work out the username, and then do something about it?

[CoZZa]

By the sounds of it its not the SMTP its the actual website, eg if they are using a PHP Script to send mail etc, i could be wrong though.

[AdamF]

Cozza is correct.

[Andrew G]

Cozza is correct.

In WHM > Server Configuration > Tweak Settings, there's an option called "Track the origin of messages sent though the mail server by adding the X-Source headers (exim 4.34+ required)"

Is that enabled?

[AdamF]

Andrew,

We are more than qualified in administering our servers - thanks.