From: Wietse Venema (no email)
Date: Thu Nov 01 2007 - 08:34:00 EDT
This is the last normal activity logging from the anvil server:
> Nov 1 10:13:03 mx-01 postfix/anvil[14283]: statistics: max connection rate 200/60s for (smtp:80.253.80.28) at Nov 1 10:04:11
> Nov 1 10:13:03 mx-01 postfix/anvil[14283]: statistics: max connection count 37 for (smtp:80.253.80.28) at Nov 1 10:04:17
> Nov 1 10:13:03 mx-01 postfix/anvil[14283]: statistics: max cache size 2003 at Nov 1 10:07:43
The above are logged within the same second, as it is should be.
The anvil server does nothing else between logging these messages,
so there never should be any delay between them.
> Nov 1 10:14:52 mx-01 postfix/anvil[14283]: statistics: max connection rate 12/60s for (smtp:66.56.131.32) at Nov 1 10:14:25
> Nov 1 10:14:56 mx-01 postfix/anvil[14283]: statistics: max connection count 13 for (smtp:220.224.9.191) at Nov 1 10:13:49
> Nov 1 10:14:57 mx-01 postfix/anvil[14283]: statistics: max cache size 1974 at Nov 1 10:14:15
And these are the correspondnig strace records. They confirm that
the time stamps are supplied by postfix/anvil.
> send(7, "<22>Nov 1 10:14:52 postfix/anvi"..., 123, MSG_NOSIGNAL) = 123
> send(7, "<22>Nov 1 10:14:56 postfix/anvi"..., 121, MSG_NOSIGNAL) = 121
> send(7, "<22>Nov 1 10:14:57 postfix/anvi"..., 92, MSG_NOSIGNAL) = 92
Note that these records are logged several seconds apart, even if
the anvil server does nothing in the mean time. Something is
dramatically slowing down the anvil server or the syslogd server
I suspect that it is the latter. On Linux, UNIX-domain sockets are
always reliable (both stream and datagram). This has serious
consequences for syslogd and its clients.
IMPORTANT: on Linux, Postfix/syslogd performance sucks horribly
under load, unless you put '-' before the /var/log/maillog name.
Be sure to "kill -HUP" the syslogd after editing syslogd.conf.
This is especially important when Postfix is experiencing a high
load (either on the incoming side or while delivering mail).
Wietse
|
|
|