Milter-greylist

I use milter-greylist already month and all was ok.
But today I'm getting too many messages "Milter (greylist): timeout before data read, where=mail"
Here piece of log. In this example connection discontinued but that happened after "rcpt to".
So what happened with milter-greylist?

Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: Milter (greylist): timeout before data read, where=mail
Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: Milter (greylist): to error state
Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: <qbjc@...>... User unknown.
Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: lost input channel from ppp91-76-73-165.pppoe.mtu-net.ru [91.76.73.165] to MTA after data
Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: from=<dima-voroncov@...>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=ppp91-76-73-165.pppoe.mtu-net.ru [91.76.73.165]

Thanks.

-- 
Vladimir Vassiliev <vova@...>

Vladimir Vassiliev a \ufffdcrit :
> I use milter-greylist already month and all was ok.
> But today I'm getting too many messages "Milter (greylist): timeout before data read, where=mail"
> Here piece of log. In this example connection discontinued but that happened after "rcpt to".
> So what happened with milter-greylist?
> 
> Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: Milter (greylist): timeout before data read, where=mail
> Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: Milter (greylist): to error state
> Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: <qbjc@...>... User unknown.
> Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: lost input channel from ppp91-76-73-165.pppoe.mtu-net.ru [91.76.73.165] to MTA after data
> Jun  5 15:07:28 mail sendmail[8199]: m55B76aq008199: from=<dima-voroncov@...>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=ppp91-76-73-165.pppoe.mtu-net.ru [91.76.73.165]
> 

You may need to increase your milter timeouts in your MTA config.

If you use SPF, DNSRBL or URLCHECK in your greylist.conf, default 
sendmail timeout is definitely too low for reliable operation. See 
Milter-greylist's README for details.

Or it may be the client itself which did not send data quick enough. 
Nevertheless in you example the client seems to be some sort of DUL or 
dynamic customer, so it doesn't matter to drop it since it's probably a 
trojaned spammer.


-- 
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.

On Thu, 05 Jun 2008 13:47:45 +0200
Benoit Branciard <benoit.branciard@...> wrote:

> You may need to increase your milter timeouts in your MTA config.
> 
> If you use SPF, DNSRBL or URLCHECK in your greylist.conf, default 
> sendmail timeout is definitely too low for reliable operation. See 
> Milter-greylist's README for details.
> 
> Or it may be the client itself which did not send data quick enough. 
> Nevertheless in you example the client seems to be some sort of DUL or 
> dynamic customer, so it doesn't matter to drop it since it's probably a 
> trojaned spammer.
> 

Thanks. It works. Only thing I can't understand, what happened today. Load seems to be the same.

-- 
Vladimir Vassiliev <vova@...>

Vladimir Vassiliev a \ufffdcrit :
> On Thu, 05 Jun 2008 13:47:45 +0200
> Benoit Branciard <benoit.branciard@...> wrote:
> 
>> You may need to increase your milter timeouts in your MTA config.
>>
>> If you use SPF, DNSRBL or URLCHECK in your greylist.conf, default 
>> sendmail timeout is definitely too low for reliable operation. See 
>> Milter-greylist's README for details.
>>
>> Or it may be the client itself which did not send data quick enough. 
>> Nevertheless in you example the client seems to be some sort of DUL or 
>> dynamic customer, so it doesn't matter to drop it since it's probably a 
>> trojaned spammer.
>>
> 
> Thanks. It works. Only thing I can't understand, what happened today. Load seems to be the same.
> 

Some DNS queries may be slower than usual; this depends not on the load 
of your system. One day we had such trouble and discovered it was caused 
by one of our DNSRBLs which took 30s to reply on each request...


-- 
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.