Forensics on the maillogs.
I made a copy of the current maillog (at 15:53) and unzipped the logs from the last week into a folder: /var/log/maillogs/temp
----------------------------------------------------------------------------------
Question: How many occurences of "EX_TEMPFAIL" where there in the maillogs?
Answer: over 6700 in to-day's so far, versus less than 500 for any day last week.
[0][root@mail]$ pwd
/var/log/maillogs/temp
[0][root@mail]$ ./count.sh
-rw------- 1 root root 5813980 Jun 5 15:53 maillog
count of EX_TEMPFAIL lines: 6762
-rw------- 1 root root 6128506 Jun 5 04:02 maillog.1
count of EX_TEMPFAIL lines: 416
-rw------- 1 root root 2696922 Jun 4 04:02 maillog.2
count of EX_TEMPFAIL lines: 293
-rw------- 1 root root 2318711 Jun 3 04:02 maillog.3
count of EX_TEMPFAIL lines: 311
-rw------- 1 root root 6230415 Jun 2 04:02 maillog.4
count of EX_TEMPFAIL lines: 336
-rw------- 1 root root 6512207 Jun 1 04:02 maillog.5
count of EX_TEMPFAIL lines: 239
-rw------- 1 root root 5758369 May 31 04:02 maillog.6
count of EX_TEMPFAIL lines: 94
-rw------- 1 root root 6263850 May 30 04:02 maillog.7
count of EX_TEMPFAIL lines: 84
----------------------------------------------------------------------------------
Question: When did those extra EX_TEMPFAIL entries occur?
Answer: Abnormal amount from 03:17 this morning until reboot.
NOTE: Log files rotate at 04:02 every day.
maillog.1: Jun 4 04:02-Jun 5 03:16 = 257 (normal for week)
Jun 5 03:17-Jun 5 04:02 = 159 (in < 1 hour)
maillog: Jun 5 04:02 Jun 5 08:47 = 6692 (until reboot)
Jun 5 10:00 Jun 5 15:53 = 70 (since reboot)
----------------------------------------------------------------------------------
Question: What was going on in the log file at 03:17?
Answer: D3200 was calling for help?
[0][root@mail]$ head down_period
Jun 5 03:17:07 mail sendmail[5601]: q55AG7Ul005598: timeout waiting for input from local during Draining Input
Jun 5 03:17:07 mail sendmail[5602]: q55AG7er005597: timeout waiting for input from local during Draining Input
Jun 5 03:17:07 mail sendmail[5605]: q55AG7jx005599: timeout waiting for input from local during Draining Input
Jun 5 03:17:07 mail sendmail[5607]: q55AG7vU005600: timeout waiting for input from local during Draining Input
Jun 5 03:17:12 mail sendmail[5678]: STARTTLS=server, relay=beta.phas.ubc.ca [142.103.236.75], version=TLSv1/SSLv3, verify=NO, cipher=DHE-RSA-AES256-SHA, bits=256/256
Jun 5 03:17:12 mail sendmail[5678]: q55AHC5k005678: from=<DS3200@phas.ubc.ca>, size=1043, class=0, nrcpts=1, msgid=<201206051017.q55AHCOE019042@beta.phas.ubc.ca>, proto=ESMTP, daemon=MTA, relay=beta.phas.ubc.ca [142.103.236.75]
Jun 5 03:17:12 mail sendmail[5679]: q55AHC5k005678: to=grieve, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=61316, dsn=4.0.0, stat=Deferred: local mailer (/usr/libexec/dovecot/deliver) exited with EX_TEMPFAIL
Jun 5 03:17:12 mail sendmail[5679]: q55AHC5k005678: to=rap, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=61316, dsn=4.0.0, stat=Deferred: local mailer (/usr/libexec/dovecot/deliver) exited with EX_TEMPFAIL
Jun 5 03:17:24 mail sendmail[5631]: q55AGOYP005630: timeout waiting for input from local during Draining Input
Jun 5 03:17:27 mail sendmail[5627]: q55AGOrG005626: timeout waiting for input from local during Draining Input
----------------------------------------------------------------------------------
Question: Was any mail successfully delivered to local inboxes between 03:17 and 10:00?
Answer: Yes, a select few:
jrottler@phas.ubc.ca = 22
hongyun@phas.ubc.ca = 1 (from aceller?)
\\kwhyte = 7
choptuik@physics.ubc.ca = 1
list-admin@physics.ubc.ca = 1
supercon@physics.ubc.ca = 1
root = 16
capexam = 5
----------------------------------------------------------------------------------