Do I need to be concerned?

Question

Hi,
As the email administrator for a small company, I am very surprised to see the following alarm warning.
Server hostname: smtp.domain
Server instance: /opt/SUNWmsgsr
Config directory: /opt/SUNWmsgsr/config
Alarmid: serverresponse
Instance: smtp
Description: server response time in seconds
Current measured value (05/Nov/2007:10:05:11 +0800): 10
Lowest recorded value: 0
Highest recorded value: 16
Monitoring interval: 600 seconds
Alarm condition is when over threshold of 10
Number of times over threshold: 15
Do I need to take action? How can I improve the response time by increasing the SMTP job?
Thanks.

Answer 1

starman7 wrote:
I can telnet to 587 - I have changed LOG_CONNECTION=3 from LOG_CONNECTION=5.LOG_CONNECTION is a bitmask field: http://docs.sun.com/app/docs/doc/819-4429/fvkdd?a=view
Therefore you need to use LOG_CONNECTION=7 to get the same behaviour as you had with LOG_CONNECTION=5 previously plus the additional logging.
29-Jan-2008 11:01:10.92 5975.3.0 tcp_submit + O TCP|127.0.0.1|587|127.0.0.1|54722 SMTP
29-Jan-2008 11:01:19.39 5975.3.1 tcp_submit + C TCP|127.0.0.1|587|127.0.0.1|54722 SMTP Error reading SMTP packetLooks like the msprobe is working correctly.
Still haven't patched, but there was no new alarm - and really no activity on the server, maybe it was the relay tests, or some RBL slowness (though I don't think any RBLs have been triggered, though perhaps they are strill checked?)It could indeed have been a combination of the two. RBL's are always checked - they will only be 'triggered' (connections refused) if the RBL lookup returns a value.
- this is a relatively unknown system as of now - although there are several relaying attempts not from the test, and smtp connection errors, expected packet, etc.
Turned back to LOG_CONNECTION=3
My mappings RBL stuff seems to only be on 25 - no reference to |587| in there...Unless your RBL lookup explicitly specify port 25 they will be checked for connections to all server ports, which includes 587.
are there any examples of this multi-threaded RBL check approach? I discussed the approach in great detail here:
http://forum.java.sun.com/thread.jspa?threadID=5233249
is a caching local DNS system still valuable? Yes, it takes load of your DNS systems and makes the overall responsiveness of the MTA better.
does the auth on 587 make it a more expensive query?Not sure what this means. The client authentication is required to allow relaying via port 587, so it's "expense" in this context is irrelevant since the cost of not having it (i.e. allowing relaying) is infinitely higher.
how/why would one perform RBL checks on 587 in the first placeYou wouldn't as there is no gain to it. External email servers (including spammers) send via port 25. If a spammer connected to port 587 they would not be able to send emails since they are unable to authenticate.
and what is a client upload port? Refer to the discussion here: http://en.wikipedia.org/wiki/Mail_submission_agent
Regards,
Shane.