Very Slow Email Delivery

[combrolegit]

Your system parameters seem to be normal. Is mail flow ok now?
Best regards,
Minh.

Yup the mail flow is very ok now, fyi the current mailbox of my zcs single server is about 1037 mailboxes, with 8 core processor and 32 G of RAM, is the mailbox too much? or there might be parameter that I can adjust so that my zcs can provide good services to 1037 mailboxes? thanks.

[zimico]

it depends on mail usage of our users. single server with about 1000 mailbox is not too big.
Note that if you started with small server and have added RAM later, you must reconfig innodb_buffer_pool_size and java_heap, please refer to
https://imanudin.net/2019/05/16/zimbra- ... ading-ram/
https://wiki.zimbra.com/wiki/Performanc ... eployments

In my experience, maybe sometime you are under SMTP attack so it will eat your zimbra resource while CPU and RAM is normal.

Best regards,
Minh.

[combrolegit]

it depends on mail usage of our users. single server with about 1000 mailbox is not too big.
Note that if you started with small server and have added RAM later, you must reconfig innodb_buffer_pool_size and java_heap, please refer to
https://imanudin.net/2019/05/16/zimbra- ... ading-ram/
https://wiki.zimbra.com/wiki/Performanc ... eployments

In my experience, maybe sometime you are under SMTP attack so it will eat your zimbra resource while CPU and RAM is normal.

Best regards,
Minh.

How to identify that? I believe it only can be done when it's happening, or maybe any way to identify SMTP attack after?

[zimico]

Hi,
Use those commands as I already referred in previous posts:

Code: Select all

# cat /var/log/zimbra.log | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'| sort | uniq -c | sort -nr
# netstat -np --protocol=inet | grep ESTABLISHED | grep :smtpd

Regards,
Minh.

[combrolegit]

Hi, I'm sorry to raise this issue again, as it reoccurring now, from your command here are the result:

539613 127.0.0.1
144852 10.66.1.116
37826 10.66.1.114
30242 10.66.2.22
28173 212.70.149.36
27287 192.168.100.20
16035 10.63.61.4

Those IP address except 212.70.149.36 are our IP Address, does it looks like an abnormal result?