Connection lost during _handle_client()
I thought that I was there ... it worked on my test machine but not on a live machine :-(
Sending an email to the list just disappears after it is given to mailman.
Debian with exim4
Exim looks OK, /var/log/exim4/mainlog says: 2024-11-28 00:59:45 1tGSsi-005OW3-1o <= addw@phcomp.co.uk H=freshmint.phcomp.co.uk (mint.phcomp.co.uk) [2001:4d48:ad51:2f00::2:2] P=esmtps X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no S=1187 id=Z0fAe9xODd2y33N8@phcomp.co.uk 2024-11-28 00:59:45 1tGSsi-005OW3-1o => chat@bray.phcomp.co.uk R=mailman3_router T=mailman3_transport H=localhost [127.0.0.1] C="250 Ok" 2024-11-28 00:59:45 1tGSsi-005OW3-1o Completed
/var/log/mailman3/smtp.log Nov 28 00:59:45 2024 (1268378) Available AUTH mechanisms: LOGIN(builtin) PLAIN(builtin) Nov 28 00:59:45 2024 (1268378) Peer: ('127.0.0.1', 42128) Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) handling connection Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) >> b'LHLO bf2024.phcomp.co.uk' Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) >> b'MAIL FROM:<addw@phcomp.co.uk> SIZE=2241' Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) sender: addw@phcomp.co.uk Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) >> b'RCPT TO:<chat@bray.phcomp.co.uk>' Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) recip: chat@bray.phcomp.co.uk Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) >> b'DATA' Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) >> b'QUIT' Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) connection lost Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) Connection lost during _handle_client()
I am concerned about the connection lost message above.
Mailman sees it, the message ID matches that at the end of the first line in the exim log (above): /var/log/mailman3/mailman.log Nov 28 00:59:45 2024 (1268377) ACCEPT: <Z0fAe9xODd2y33N8@phcomp.co.uk>
Is there any more logging that I can look-at/switch-on to see what is happening ?
Thanks
-- Alain Williams Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer. +44 (0) 787 668 0256 https://www.phcomp.co.uk/ Parliament Hill Computers. Registration Information: https://www.phcomp.co.uk/Contact.html #include <std_disclaimer.h>
On 11/27/24 5:58 PM, Alain D D Williams wrote:
Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) connection lost Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) Connection lost during _handle_client()
I am concerned about the connection lost message above.
It is normal and not a concern.
Mailman sees it, the message ID matches that at the end of the first line in the exim log (above): /var/log/mailman3/mailman.log Nov 28 00:59:45 2024 (1268377) ACCEPT: <Z0fAe9xODd2y33N8@phcomp.co.uk>
So Mailman got the message and accepted it.
Is there any more logging that I can look-at/switch-on to see what is happening ?
Is there anything else in mailman.log? Does the message get archived? Is
there anthing in any of Mailman's var/queue/* directories? Is Mailman
core running? Does mailman members --nomail enabled
list any members?
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
On Wed, Nov 27, 2024 at 08:47:38PM -0800, Mark Sapiro wrote:
On 11/27/24 5:58 PM, Alain D D Williams wrote:
Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) connection lost Nov 28 00:59:45 2024 (1268378) ('127.0.0.1', 42128) Connection lost during _handle_client()
I am concerned about the connection lost message above.
It is normal and not a concern.
Mailman sees it, the message ID matches that at the end of the first line in the exim log (above): /var/log/mailman3/mailman.log Nov 28 00:59:45 2024 (1268377) ACCEPT: <Z0fAe9xODd2y33N8@phcomp.co.uk>
So Mailman got the message and accepted it.
Is there any more logging that I can look-at/switch-on to see what is happening ?
Is there anything else in mailman.log? Does the message get archived?
Is there anthing in any of Mailman's var/queue/* directories?
/var/lib/mailman3/queue/out/ contains 4 .pck files and one .bak file. There are being continually read & replaced by other files of similar names - like 1732809409.1069376+eb3354a0fc1f0a9bfa95ff7e15e2430ab7c2b885.pck The process doing this is a 'qrunner'
I am getting ~50 lines/second appended to /var/log/mailman3/web/mailman-web.log
[pid: 1348330|app: 0|req: 4366/4366] ::1 () {54 vars in 1065 bytes} [Thu Nov 28 17:02:18 2024] GET /mailman3/hyperkitty/api/mailman/urls?mlist=chat%40bray.phcomp.co.uk&msgid=Z0iJAoTHHrzK2ypO%40phcomp.co.uk => generated 126 bytes in 3 msecs (HTTP/1.1 200) 7 headers in 220 bytes (1 switches on core 1)
Yes: the mail list is chat@bray.phcomp.co.uk
/var/lib/mailman3/queue/shunt/ contains 4 .pck files.
Is Mailman core running?
Systemctl says so & ps shows me one 'master', several 'runner' & 2 uwsgi
Does
mailman members --nomail enabled
list any members?
Yes: it gives the list that I expect.
-- Alain Williams Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer. +44 (0) 787 668 0256 https://www.phcomp.co.uk/ Parliament Hill Computers. Registration Information: https://www.phcomp.co.uk/Contact.html #include <std_disclaimer.h>
On 11/28/24 9:17 AM, Alain D D Williams wrote:
/var/lib/mailman3/queue/out/ contains 4 .pck files and one .bak file. There are being continually read & replaced by other files of similar names - like 1732809409.1069376+eb3354a0fc1f0a9bfa95ff7e15e2430ab7c2b885.pck The process doing this is a 'qrunner'
The .bak file is the one currently being processed by the out
runner.
The others are waiting to be sent.
I don't know why they are continually being dequeued and requeued I
suggest you stop Mailman core and then examine these files with mailman qfile
to see if there is some issue with one or more of them, but this
seems unlikely. More likely is some issue with the out
runner itself,
but I have no idea what that would be except that issues like this can
be caused by files in Mailman's var/templates/ directory that aren't
readable by the Mailman user (often caused by running mailman import21
as root).
I am getting ~50 lines/second appended to /var/log/mailman3/web/mailman-web.log
[pid: 1348330|app: 0|req: 4366/4366] ::1 () {54 vars in 1065 bytes} [Thu Nov 28 17:02:18 2024] GET /mailman3/hyperkitty/api/mailman/urls?mlist=chat%40bray.phcomp.co.uk&msgid=Z0iJAoTHHrzK2ypO%40phcomp.co.uk => generated 126 bytes in 3 msecs (HTTP/1.1 200) 7 headers in 220 bytes (1 switches on core 1)
This looks like some kind of DOS attack. Look at the GET requests in the web server log.
/var/lib/mailman3/queue/shunt/ contains 4 .pck files.
For each of these, there should be an entry in mailman.log indicating
the exception with a traceback. Look for entries in the log ending with
a SHUNTING
message.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (2)
-
Alain D D Williams
-
Mark Sapiro