1 Topic by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Topic: My sub accounts can not receive emails, it was normal before thursday.

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.3 MARIADB edition.
- Deployed with iRedMail Easy or the downloadable installer? the downloadable installer
- Linux/BSD distribution name and version: Debian 11 x64 (bullseye)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? iredadmin
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hi:
All my sub accounts can not receive emails since this Thursday, and the last email my postmaster account received on this Wednesday was:

################### Logwatch 7.5.5 (01/22/21) ####################
        Processing Initiated: Wed Jul 12 06:25:05 2023
        Date Range Processed: yesterday
                              ( 2023-Jul-11 )
                              Period is day.
        Detail Level of Output: 0
        Type of Output/Format: mail / text
        Logfiles for Host: mail
##################################################################

--------------------- Amavisd-new Begin ------------------------

       36   *Warning: Virus scanner connection failure
       27   Miscellaneous warnings

        9   Total messages scanned ------------------  100.00%
   96.903K  Total bytes scanned                         99,229
========   ==================================================

        9   Passed ----------------------------------  100.00%
        9     Unchecked passed                         100.00%
========   ==================================================

        9   Unchecked -------------------------------  100.00%
        9     Unchecked passed                         100.00%
========   ==================================================


---------------------- Amavisd-new End -------------------------


--------------------- httpd Begin ------------------------


Connection attempts using mod_proxy:
    45.128.232.176 -> google.com:443: 1 Time(s)
    84.54.51.12 -> google.com:443: 1 Time(s)

---------------------- httpd End -------------------------


--------------------- pam_unix Begin ------------------------

sshd:
    Authentication Failures:
       root (218.92.0.118): 37 Time(s)
       unknown (201.55.32.182): 34 Time(s)
       root (218.92.0.31): 33 Time(s)
       root (218.92.0.112): 32 Time(s)
       root (218.92.0.24): 32 Time(s)
       root (218.92.0.29): 32 Time(s)
       root (218.92.0.113): 29 Time(s)
       root (180.101.88.247): 28 Time(s)
       root (218.92.0.22): 28 Time(s)
       root (218.92.0.23): 28 Time(s)
       root (218.92.0.25): 28 Time(s)
       root (61.177.172.160): 28 Time(s)
       root (61.177.172.179): 28 Time(s)
       root (201.55.32.182): 27 Time(s)
       root (218.92.0.34): 24 Time(s)
       unknown (45.95.146.47): 24 Time(s)
       root (61.177.172.140): 20 Time(s)
       root (218.92.0.107): 19 Time(s)
       unknown (141.98.11.113): 19 Time(s)
       root (45.95.146.47): 18 Time(s)
       root (218.92.0.27): 16 Time(s)
       root (218.92.0.56): 16 Time(s)
       root (61.177.172.185): 16 Time(s)
       unknown (141.98.11.11): 16 Time(s)
       root (218.92.0.108): 12 Time(s)
       root (141.98.11.11): 9 Time(s)
       root (218.92.0.35): 8 Time(s)
       root (141.98.11.113): 7 Time(s)
       root (103.123.63.116): 5 Time(s)
       root (176.113.115.210): 5 Time(s)
       root (187.44.214.58): 5 Time(s)
       root (92.46.108.20): 5 Time(s)
       unknown (188.121.117.188): 5 Time(s)
       root (165.227.85.21): 4 Time(s)
       root (45.129.14.51): 4 Time(s)
       unknown (103.250.11.146): 4 Time(s)
       unknown (176.113.115.211): 4 Time(s)
       root (103.250.11.146): 3 Time(s)
       root (128.199.20.210): 3 Time(s)
       root (134.209.127.189): 3 Time(s)
       root (139.59.226.121): 3 Time(s)
       root (178.62.122.135): 3 Time(s)
       root (187.190.252.172): 3 Time(s)
       root (191.100.20.29): 3 Time(s)
       root (209.141.46.19): 3 Time(s)
       root (41.223.99.89): 3 Time(s)
       root (42.200.149.223): 3 Time(s)
       root (43.156.240.197): 3 Time(s)
       root (45.64.186.118): 3 Time(s)
       root (49.207.180.112): 3 Time(s)
       unknown (103.63.108.25): 3 Time(s)
       unknown (122.117.51.33): 3 Time(s)
       unknown (129.226.221.72): 3 Time(s)
       unknown (134.17.16.177): 3 Time(s)
       unknown (143.198.126.248): 3 Time(s)
       unknown (146.190.96.229): 3 Time(s)
       unknown (15.204.49.195): 3 Time(s)
       unknown (154.88.30.29): 3 Time(s)
       unknown (176.113.115.210): 3 Time(s)
       unknown (178.128.34.59): 3 Time(s)
       unknown (182.229.10.141): 3 Time(s)
       unknown (189.16.195.50): 3 Time(s)
       unknown (191.240.156.170): 3 Time(s)
       unknown (20.228.150.123): 3 Time(s)
       unknown (206.189.153.223): 3 Time(s)
       unknown (221.156.126.1): 3 Time(s)
       unknown (34.100.196.103): 3 Time(s)
       unknown (35.229.206.177): 3 Time(s)
       unknown (40.114.242.120): 3 Time(s)
       unknown (43.135.181.188): 3 Time(s)
       unknown (43.153.124.128): 3 Time(s)
       unknown (43.153.20.27): 3 Time(s)
       unknown (43.156.243.235): 3 Time(s)
       unknown (47.254.134.75): 3 Time(s)
       unknown (81.89.110.244): 3 Time(s)
       unknown (91.151.11.158): 3 Time(s)
       unknown (93.56.38.231): 3 Time(s)
       root (128.199.145.5): 2 Time(s)
       root (140.238.177.83): 2 Time(s)
       root (159.203.81.114): 2 Time(s)
       root (176.113.115.211): 2 Time(s)
       root (182.16.245.85): 2 Time(s)
       root (195.33.237.83): 2 Time(s)
       root (198.23.165.102): 2 Time(s)
       root (201.217.217.86): 2 Time(s)
       root (222.165.138.144): 2 Time(s)
       root (27.254.235.2): 2 Time(s)
       root (34.71.89.17): 2 Time(s)
       root (43.154.184.101): 2 Time(s)
       root (43.155.87.172): 2 Time(s)
       root (43.163.230.138): 2 Time(s)
       root (89.37.3.117): 2 Time(s)
       unknown (102.128.78.76): 2 Time(s)
       unknown (103.189.235.189): 2 Time(s)
       unknown (107.173.144.254): 2 Time(s)
       unknown (112.64.45.138): 2 Time(s)
       unknown (118.219.54.135): 2 Time(s)
       unknown (121.83.122.242): 2 Time(s)
       unknown (128.199.145.5): 2 Time(s)
       unknown (129.151.119.28): 2 Time(s)
       unknown (132.145.150.210): 2 Time(s)
       unknown (140.238.177.83): 2 Time(s)
       unknown (144.217.13.134): 2 Time(s)
       unknown (159.203.81.114): 2 Time(s)
       unknown (165.22.21.48): 2 Time(s)
       unknown (167.71.54.30): 2 Time(s)
       unknown (175.203.61.33): 2 Time(s)
       unknown (182.16.245.85): 2 Time(s)
       unknown (182.75.216.74): 2 Time(s)
       unknown (183.105.214.111): 2 Time(s)
       unknown (185.38.142.170): 2 Time(s)
       unknown (185.77.96.124): 2 Time(s)
       unknown (195.33.237.83): 2 Time(s)
       unknown (197.5.145.73): 2 Time(s)
       unknown (198.23.165.102): 2 Time(s)
       unknown (20.229.13.167): 2 Time(s)
       unknown (201.217.217.86): 2 Time(s)
       unknown (202.125.94.212): 2 Time(s)
       unknown (206.217.131.233): 2 Time(s)
       unknown (206.81.2.232): 2 Time(s)
       unknown (207.154.215.181): 2 Time(s)
       unknown (210.17.230.213): 2 Time(s)
       unknown (221.213.63.210): 2 Time(s)
       unknown (222.165.138.144): 2 Time(s)
       unknown (27.254.235.2): 2 Time(s)
       unknown (31.179.234.178): 2 Time(s)
       unknown (34.71.89.17): 2 Time(s)
       unknown (43.130.151.173): 2 Time(s)
       unknown (43.131.254.121): 2 Time(s)
       unknown (43.134.30.181): 2 Time(s)
       unknown (43.153.21.32): 2 Time(s)
       unknown (43.154.102.160): 2 Time(s)
       unknown (43.154.168.144): 2 Time(s)
       unknown (43.154.184.101): 2 Time(s)
       unknown (43.155.87.172): 2 Time(s)
       unknown (43.159.39.194): 2 Time(s)
       unknown (43.163.230.138): 2 Time(s)
       unknown (47.236.22.224): 2 Time(s)
       unknown (47.236.26.14): 2 Time(s)
       unknown (47.90.133.204): 2 Time(s)
       unknown (51.250.92.44): 2 Time(s)
       unknown (59.12.160.91): 2 Time(s)
       unknown (61.42.20.175): 2 Time(s)
       unknown (64.226.103.75): 2 Time(s)
       unknown (72.167.44.240): 2 Time(s)
       unknown (75.129.117.141): 2 Time(s)
       unknown (80.76.42.117): 2 Time(s)
       unknown (82.165.239.97): 2 Time(s)
       unknown (89.208.104.244): 2 Time(s)
       unknown (89.37.3.117): 2 Time(s)
       unknown (93.108.242.140): 2 Time(s)
       backup (129.151.119.28): 1 Time(s)
       backup (141.98.11.11): 1 Time(s)
       mysql (141.98.11.11): 1 Time(s)
       mysql (141.98.11.113): 1 Time(s)
       mysql (210.17.230.213): 1 Time(s)
       mysql (75.129.117.141): 1 Time(s)
       nobody (141.98.11.11): 1 Time(s)
       root (103.189.235.189): 1 Time(s)
       root (105.73.197.126): 1 Time(s)
       root (107.173.144.254): 1 Time(s)
       root (112.64.45.138): 1 Time(s)
       root (118.219.54.135): 1 Time(s)
       root (121.120.43.54): 1 Time(s)
       root (121.83.122.242): 1 Time(s)
       root (123.24.67.162): 1 Time(s)
       root (132.145.150.210): 1 Time(s)
       root (144.217.13.134): 1 Time(s)
       root (165.22.21.48): 1 Time(s)
       root (167.71.54.30): 1 Time(s)
       root (175.203.61.33): 1 Time(s)
       root (182.75.216.74): 1 Time(s)
       root (183.105.214.111): 1 Time(s)
       root (185.38.142.170): 1 Time(s)
       root (185.77.96.124): 1 Time(s)
       root (188.121.117.188): 1 Time(s)
       root (197.5.145.73): 1 Time(s)
       root (20.229.13.167): 1 Time(s)
       root (200.91.234.36): 1 Time(s)
       root (202.125.94.212): 1 Time(s)
       root (206.217.131.233): 1 Time(s)
       root (206.81.2.232): 1 Time(s)
       root (213.230.124.17): 1 Time(s)
       root (221.213.63.210): 1 Time(s)
       root (31.179.234.178): 1 Time(s)
       root (43.130.151.173): 1 Time(s)
       root (43.131.254.121): 1 Time(s)
       root (43.134.30.181): 1 Time(s)
       root (43.153.21.32): 1 Time(s)
       root (43.154.102.160): 1 Time(s)
       root (43.154.168.144): 1 Time(s)
       root (43.159.39.194): 1 Time(s)
       root (47.236.22.224): 1 Time(s)
       root (47.236.26.14): 1 Time(s)
       root (47.90.133.204): 1 Time(s)
       root (51.250.92.44): 1 Time(s)
       root (59.12.160.91): 1 Time(s)
       root (61.42.20.175): 1 Time(s)
       root (64.226.103.75): 1 Time(s)
       root (69.50.128.171): 1 Time(s)
       root (72.167.44.240): 1 Time(s)
       root (80.76.42.117): 1 Time(s)
       root (81.232.19.87): 1 Time(s)
       root (82.165.239.97): 1 Time(s)
       root (89.208.104.244): 1 Time(s)
       root (93.108.242.140): 1 Time(s)
       unknown (103.186.172.254): 1 Time(s)
       unknown (112.170.246.70): 1 Time(s)
       unknown (121.136.227.217): 1 Time(s)
       unknown (121.190.114.78): 1 Time(s)
       unknown (121.202.199.50): 1 Time(s)
       unknown (128.199.20.210): 1 Time(s)
       unknown (134.209.127.189): 1 Time(s)
       unknown (138.75.53.156): 1 Time(s)
       unknown (139.59.226.121): 1 Time(s)
       unknown (150.249.171.94): 1 Time(s)
       unknown (161.8.202.36): 1 Time(s)
       unknown (165.227.85.21): 1 Time(s)
       unknown (165.90.126.182): 1 Time(s)
       unknown (173.196.207.219): 1 Time(s)
       unknown (175.156.137.15): 1 Time(s)
       unknown (175.197.122.232): 1 Time(s)
       unknown (178.219.124.47): 1 Time(s)
       unknown (178.62.122.135): 1 Time(s)
       unknown (179.5.193.196): 1 Time(s)
       unknown (181.21.55.183): 1 Time(s)
       unknown (183.171.151.2): 1 Time(s)
       unknown (187.190.252.172): 1 Time(s)
       unknown (191.100.20.29): 1 Time(s)
       unknown (193.33.58.135): 1 Time(s)
       unknown (195.239.164.190): 1 Time(s)
       unknown (197.48.169.124): 1 Time(s)
       unknown (201.59.171.42): 1 Time(s)
       unknown (201.86.114.73): 1 Time(s)
       unknown (203.228.37.21): 1 Time(s)
       unknown (209.141.46.19): 1 Time(s)
       unknown (218.156.128.226): 1 Time(s)
       unknown (220.80.74.79): 1 Time(s)
       unknown (220.93.239.144): 1 Time(s)
       unknown (221.167.164.212): 1 Time(s)
       unknown (223.22.233.94): 1 Time(s)
       unknown (41.223.99.89): 1 Time(s)
       unknown (42.200.149.223): 1 Time(s)
       unknown (43.156.240.197): 1 Time(s)
       unknown (45.64.186.118): 1 Time(s)
       unknown (49.207.180.112): 1 Time(s)
       unknown (61.240.138.34): 1 Time(s)
       unknown (64.124.229.152): 1 Time(s)
       unknown (90.151.249.218): 1 Time(s)
    Invalid Users:
       Unknown Account: 375 Time(s)


---------------------- pam_unix End -------------------------


--------------------- Postfix Begin ------------------------

   96.160K  Bytes accepted                              98,468
  103.298K  Bytes delivered                            105,777
   29.118K  Bytes forwarded                             29,817
========   ==================================================

        9   Accepted                                    81.82%
        2   Rejected                                    18.18%
--------   --------------------------------------------------
       11   Total                                      100.00%
========   ==================================================

        2   5xx Reject relay denied                    100.00%
--------   --------------------------------------------------
        2   Total 5xx Rejects                          100.00%
========   ==================================================

        9   Connections                                      9
        9   Disconnections                                   9
       20   Removed from queue                              20
        9   Delivered                                        9
        2   Forwarded                                        2
      168   Postscreen                                     168

        7   TLS connections (server)                         7


---------------------- Postfix End -------------------------


--------------------- SSHD Begin ------------------------


Network Read Write Errors: 8

Negotiation failed:
    no matching key exchange method found: 95 Times

Failed logins from:
    20.229.13.167: 1 Time
    27.254.235.2: 2 Times
    31.179.234.178: 1 Time
    34.71.89.17 (17.89.71.34.bc.googleusercontent.com): 2 Times
    41.223.99.89: 3 Times
    42.200.149.223 (42-200-149-223.static.imsbiz.com): 3 Times
    43.130.151.173: 1 Time
    43.131.254.121: 1 Time
    43.134.30.181: 1 Time
    43.153.21.32: 1 Time
    43.154.102.160: 1 Time
    43.154.168.144: 1 Time
    43.154.184.101: 2 Times
    43.155.87.172: 2 Times
    43.156.240.197: 3 Times
    43.159.39.194: 1 Time
    43.163.230.138: 2 Times
    45.64.186.118 (45-64-186-118.static.bangmod-idc.com): 3 Times
    45.95.146.47 (boaokgrove.store): 18 Times
    45.129.14.51 (sanchez.explorethebest.com): 4 Times
    47.90.133.204: 1 Time
    47.236.22.224: 1 Time
    47.236.26.14: 1 Time
    49.207.180.112 (49.207.180.112.actcorp.in): 3 Times
    51.250.92.44: 1 Time
    59.12.160.91: 1 Time
    61.42.20.175: 1 Time
    61.177.172.140: 27 Times
    61.177.172.160: 38 Times
    61.177.172.179: 37 Times
    61.177.172.185: 23 Times
    64.226.103.75: 1 Time
    69.50.128.171 (logicde-1.as22384.net): 1 Time
    72.167.44.240 (240.44.167.72.host.secureserver.net): 1 Time
    75.129.117.141 (075-129-117-141.res.spectrum.com): 1 Time
    80.76.42.117 (549885.msk-kvm.ru): 1 Time
    81.232.19.87 (81-232-19-87-no600.tbcn.telia.com): 1 Time
    82.165.239.97 (ip82-165-239-97.pbiaas.com): 1 Time
    89.37.3.117 (117.mobinnet.net): 2 Times
    89.208.104.244 (myownvpnserver.aeza.network): 1 Time
    92.46.108.20: 5 Times
    93.108.242.140 (140.242.108.93.rev.vodafone.pt): 1 Time
    103.123.63.116 (ip103-123-63-116.cloudhost.web.id): 5 Times
    103.189.235.189 (ip103-189-235-189.cloudhost.web.id): 1 Time
    103.250.11.146 (ip103-250-11-146.cloudhost.web.id): 3 Times
    105.73.197.126: 1 Time
    107.173.144.254 (107-173-144-254-host.colocrossing.com): 1 Time
    112.64.45.138: 1 Time
    118.219.54.135: 1 Time
    121.83.122.242 (121-83-122-242f1.shg1.eonet.ne.jp): 1 Time
    121.120.43.54: 1 Time
    123.24.67.162 (dynamic.vdc.vn): 5 Times
    128.199.20.210: 3 Times
    128.199.145.5: 2 Times
    129.151.119.28: 1 Time
    132.145.150.210: 1 Time
    134.209.127.189: 3 Times
    139.59.226.121: 3 Times
    140.238.177.83: 2 Times
    141.98.11.11 (axon-stall.riddlecamera.net): 12 Times
    141.98.11.113 (annoying.medyamol.com): 8 Times
    144.217.13.134 (vps-2cf81da8.vps.ovh.ca): 1 Time
    159.203.81.114 (inspector-apps.com): 2 Times
    165.22.21.48: 1 Time
    165.227.85.21 (officehuddle.com-main-site): 4 Times
    167.71.54.30: 1 Time
    175.203.61.33: 1 Time
    176.113.115.210: 5 Times
    176.113.115.211: 2 Times
    178.62.122.135: 3 Times
    180.101.88.247: 37 Times
    182.16.245.85 (ip-182-16-245-85.interlink.net.id): 2 Times
    182.75.216.74 (nsg-static-74.216.75.182-airtel.com): 1 Time
    183.105.214.111: 1 Time
    185.38.142.170 (dsds.sa): 1 Time
    185.77.96.124: 1 Time
    187.44.214.58 (187-44-214-58.STATIC.itsweb.com.br): 5 Times
    187.190.252.172 (fixed-187-190-252-172.totalplay.net): 3 Times
    188.121.117.188: 1 Time
    191.100.20.29 (29.191-100-20.etapanet.net): 3 Times
    195.33.237.83 (ank-a5-11-asy28.ank-ro-04.superonline.com): 2 Times
    197.5.145.73: 1 Time
    198.23.165.102 (198-23-165-102-host.colocrossing.com): 2 Times
    200.91.234.36 (desenliste.ifxcorp.com): 1 Time
    201.55.32.182: 27 Times
    201.217.217.86 (201-217-217-86-host.ifx.net.co): 2 Times
    202.125.94.212: 1 Time
    206.81.2.232: 1 Time
    206.217.131.233 (206-217-131-233-host.colocrossing.com): 1 Time
    209.141.46.19 (irc.tgfluff.net): 3 Times
    210.17.230.213: 1 Time
    213.230.124.17 (17.64.uzpak.uz): 1 Time
    218.92.0.22: 38 Times
    218.92.0.23: 36 Times
    218.92.0.24: 44 Times
    218.92.0.25: 38 Times
    218.92.0.27: 20 Times
    218.92.0.29: 42 Times
    218.92.0.31: 44 Times
    218.92.0.34: 34 Times
    218.92.0.35: 10 Times
    218.92.0.56: 23 Times
    218.92.0.107: 24 Times
    218.92.0.108: 16 Times
    218.92.0.112: 41 Times
    218.92.0.113: 35 Times
    218.92.0.118: 50 Times
    221.213.63.210: 1 Time
    222.165.138.144: 2 Times

Illegal users from:
    15.204.49.195 (ip195.ip-15-204-49.us): 3 Times
    20.228.150.123: 3 Times
    20.229.13.167: 2 Times
    27.254.235.2: 2 Times
    31.179.234.178: 2 Times
    34.71.89.17 (17.89.71.34.bc.googleusercontent.com): 2 Times
    34.100.196.103 (103.196.100.34.bc.googleusercontent.com): 3 Times
    35.229.206.177 (177.206.229.35.bc.googleusercontent.com): 3 Times
    40.114.242.120: 3 Times
    41.223.99.89: 1 Time
    42.200.149.223 (42-200-149-223.static.imsbiz.com): 1 Time
    43.130.151.173: 2 Times
    43.131.254.121: 2 Times
    43.134.30.181: 2 Times
    43.135.181.188: 3 Times
    43.153.20.27: 3 Times
    43.153.21.32: 2 Times
    43.153.124.128: 3 Times
    43.154.102.160: 2 Times
    43.154.168.144: 2 Times
    43.154.184.101: 2 Times
    43.155.87.172: 2 Times
    43.156.240.197: 1 Time
    43.156.243.235: 3 Times
    43.159.39.194: 2 Times
    43.163.230.138: 2 Times
    45.64.186.118 (45-64-186-118.static.bangmod-idc.com): 1 Time
    45.95.146.47 (boaokgrove.store): 25 Times
    45.129.14.51 (sanchez.explorethebest.com): 2 Times
    47.90.133.204: 2 Times
    47.236.22.224: 2 Times
    47.236.26.14: 2 Times
    47.254.134.75: 3 Times
    49.207.180.112 (49.207.180.112.actcorp.in): 1 Time
    51.250.92.44: 2 Times
    59.12.160.91: 2 Times
    61.42.20.175: 2 Times
    61.240.138.34: 1 Time
    64.124.229.152 (64.124.229.152.IDIA-093835-006-ZYO.zip.zayo.com): 1 Time
    64.226.103.75: 2 Times
    65.49.1.14: 1 Time
    72.167.44.240 (240.44.167.72.host.secureserver.net): 2 Times
    75.129.117.141 (075-129-117-141.res.spectrum.com): 2 Times
    80.76.42.117 (549885.msk-kvm.ru): 2 Times
    81.89.110.244 (81-89-110-244.blue.kundencontroller.de): 3 Times
    82.165.239.97 (ip82-165-239-97.pbiaas.com): 2 Times
    89.37.3.117 (117.mobinnet.net): 2 Times
    89.208.104.244 (myownvpnserver.aeza.network): 2 Times
    90.151.249.218: 1 Time
    91.151.11.158 (mainserver.htmgt.co.uk): 3 Times
    93.56.38.231 (fastweb.oema.it): 3 Times
    93.108.242.140 (140.242.108.93.rev.vodafone.pt): 2 Times
    102.128.78.76: 2 Times
    103.63.108.25 (static.cmcti.vn): 3 Times
    103.186.172.254: 1 Time
    103.189.235.189 (ip103-189-235-189.cloudhost.web.id): 2 Times
    103.250.11.146 (ip103-250-11-146.cloudhost.web.id): 4 Times
    107.173.144.254 (107-173-144-254-host.colocrossing.com): 2 Times
    112.64.45.138: 2 Times
    112.170.246.70: 4 Times
    118.219.54.135: 2 Times
    121.83.122.242 (121-83-122-242f1.shg1.eonet.ne.jp): 2 Times
    121.136.227.217: 5 Times
    121.190.114.78: 4 Times
    121.202.199.50 (m121-202-199-50.smartone.com): 1 Time
    122.117.51.33 (122-117-51-33.hinet-ip.hinet.net): 3 Times
    128.199.20.210: 1 Time
    128.199.145.5: 2 Times
    129.151.119.28: 2 Times
    129.226.221.72: 3 Times
    132.145.150.210: 2 Times
    134.17.16.177 (177-16-17-134-cloud.mts.by): 3 Times
    134.209.127.189: 1 Time
    138.75.53.156: 1 Time
    139.59.226.121: 1 Time
    140.238.177.83: 2 Times
    141.98.11.11 (axon-stall.riddlecamera.net): 17 Times
    141.98.11.113 (annoying.medyamol.com): 21 Times
    143.198.126.248: 3 Times
    144.217.13.134 (vps-2cf81da8.vps.ovh.ca): 2 Times
    146.190.96.229: 3 Times
    150.249.171.94 (fp96f9ab5e.stmb207.ap.nuro.jp): 1 Time
    154.88.30.29: 3 Times
    159.203.81.114 (inspector-apps.com): 2 Times
    161.8.202.36: 1 Time
    165.22.21.48: 2 Times
    165.90.126.182: 1 Time
    165.227.85.21 (officehuddle.com-main-site): 1 Time
    167.71.54.30: 2 Times
    173.196.207.219 (rrcs-173-196-207-219.west.biz.rr.com): 1 Time
    175.156.137.15: 1 Time
    175.197.122.232: 4 Times
    175.203.61.33: 2 Times
    176.113.115.210: 3 Times
    176.113.115.211: 4 Times
    178.62.122.135: 1 Time
    178.128.34.59: 3 Times
    178.219.124.47 (host-178.219.124.47-c3.net.pl): 1 Time
    179.5.193.196: 1 Time
    181.21.55.183 (181-21-55-183.speedy.com.ar): 1 Time
    182.16.245.85 (ip-182-16-245-85.interlink.net.id): 2 Times
    182.75.216.74 (nsg-static-74.216.75.182-airtel.com): 2 Times
    182.229.10.141: 3 Times
    183.105.214.111: 2 Times
    183.136.225.5: 1 Time
    183.171.151.2: 1 Time
    185.38.142.170 (dsds.sa): 2 Times
    185.77.96.124: 2 Times
    187.190.252.172 (fixed-187-190-252-172.totalplay.net): 1 Time
    188.121.117.188: 5 Times
    189.16.195.50: 3 Times
    191.100.20.29 (29.191-100-20.etapanet.net): 1 Time
    191.240.156.170 (170.156.240.191.as28165.wcs.net.br): 3 Times
    193.33.58.135: 1 Time
    195.33.237.83 (ank-a5-11-asy28.ank-ro-04.superonline.com): 2 Times
    195.239.164.190 (Sogaz-gw.Irkutsk.gldn.net): 1 Time
    197.5.145.73: 2 Times
    197.48.169.124 (host-197.48.169.124.tedata.net): 1 Time
    198.23.165.102 (198-23-165-102-host.colocrossing.com): 2 Times
    200.6.218.173 (173.218.6.200.static.intelnet.net.gt): 1 Time
    201.55.32.182: 34 Times
    201.59.171.42: 1 Time
    201.86.114.73 (atm25141.bhe.gvt.net.br): 1 Time
    201.217.217.86 (201-217-217-86-host.ifx.net.co): 2 Times
    202.125.94.212: 2 Times
    203.228.37.21: 4 Times
    206.81.2.232: 2 Times
    206.189.153.223: 3 Times
    206.217.131.233 (206-217-131-233-host.colocrossing.com): 2 Times
    207.154.215.181: 2 Times
    209.141.46.19 (irc.tgfluff.net): 1 Time
    210.17.230.213: 2 Times
    218.156.128.226: 4 Times
    220.80.74.79: 4 Times
    220.93.239.144: 4 Times
    221.156.126.1: 3 Times
    221.167.164.212: 4 Times
    221.213.63.210: 2 Times
    222.165.138.144: 2 Times
    223.22.233.94 (223-22-233-94.mobile.dynamic.aptg.com.tw): 1 Time

Received disconnect:
     [preauth] : 126 Times
    Bye Bye [preauth] : 366 Times

**Unmatched Entries**
error: kex_exchange_identification: Connection closed by remote host : 16 Times
error: kex_exchange_identification: banner line contains invalid characters : 4 Times
error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 13 Times
error: kex_exchange_identification: client sent invalid protocol identifier "MGLNDD_141.164.48.32_22" : 1 Time
error: kex_exchange_identification: read: Connection reset by peer : 1 Time

---------------------- SSHD End -------------------------


--------------------- Disk Space Begin ------------------------

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        24G  7.1G   16G  32% /


---------------------- Disk Space End -------------------------


--------------------- lm_sensors output Begin ------------------------

No sensors found!
Make sure you loaded all the kernel drivers you need.
Try sensors-detect to find out which these are.

---------------------- lm_sensors output End -------------------------


###################### Logwatch End #########################

Just now I login the sub account, and I use my personal email to send an email to my sub account, but the result is that my sub account can not receive email.

Here is the log from /var/log/mail.log:

Jul 15 15:47:34 mail roundcube: <q3rpvcm4> Successful login for anthony.cj@sohoono.com (ID: 5) from 45.76.78.208 in session q3rpvcm4a2o5oesv
Jul 15 15:48:07 mail roundcube: <qrg72dtb> Successful login for anthony.shareasale@sohoono.com (ID: 6) from 45.76.78.208 in session qrg72dtboqa97v4n
Jul 15 15:50:09 mail postfix/postscreen[888838]: CONNECT from [162.62.58.211]:52113 to [141.164.48.32]:25
Jul 15 15:50:15 mail postfix/postscreen[888838]: PASS NEW [162.62.58.211]:52113
Jul 15 15:50:16 mail postfix/smtpd[888907]: connect from out162-62-58-211.mail.qq.com[162.62.58.211]
Jul 15 15:50:17 mail postfix/smtpd[888907]: Anonymous TLS connection established from out162-62-58-211.mail.qq.com[162.62.58.211]: TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)
Jul 15 15:50:19 mail postfix/smtpd[888907]: 4R3CV32grNzCcfs: client=out162-62-58-211.mail.qq.com[162.62.58.211]
Jul 15 15:50:20 mail postfix/cleanup[888964]: 4R3CV32grNzCcfs: message-id=<tencent_16F31EEA7A45162BAC88847871D051EE3E08@qq.com>
Jul 15 15:50:20 mail postfix/qmgr[2295]: 4R3CV32grNzCcfs: from=<xxxxxxxxx@qq.com>, size=2886, nrcpt=1 (queue active)
Jul 15 15:50:20 mail postfix/amavis/smtp[888985]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused
Jul 15 15:50:20 mail postfix/amavis/smtp[888985]: 4R3CV32grNzCcfs: to=<anthony.shareasale@sohoono.com>, relay=none, delay=1.8, delays=1.7/0.02/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:21 mail postfix/smtpd[888907]: disconnect from out162-62-58-211.mail.qq.com[162.62.58.211] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R2vrH3PSwzCcfT: from=<noreply@cj.com>, size=5489, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R1sP26gw4zCccR: from=<noreply@cj.com>, size=5744, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R1mqZ648yzCcbk: from=<noreply@cj.com>, size=7700, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R25vb0YVvzCccf: from=<noreply@cj.com>, size=6326, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R2YC837RvzCcdJ: from=<noreply@cj.com>, size=5590, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: 4R2vrH3PSwzCcfT: to=<anthony.cj@sohoono.com>, relay=none, delay=42346, delays=42346/0/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R2v3v1m8fzCcfM: from=<root@mail.sohoono.com>, size=1211, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R2vrJ1P8LzCcfV: from=<noreply@cj.com>, size=4022, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R2vrG5NCVzCcfS: from=<noreply@cj.com>, size=2600, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/qmgr[2295]: 4R2m4R2Wp8zCcfC: from=<noreply@cj.com>, size=28479, nrcpt=1 (queue active)
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: 4R1sP26gw4zCccR: to=<anthony.cj@sohoono.com>, relay=none, delay=189571, delays=189571/0.01/0.02/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: 4R1mqZ648yzCcbk: to=<anthony.cj@sohoono.com>, relay=none, delay=201919, delays=201919/0.03/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: connect to 127.0.0.1[127.0.0.1]:10026: Connection refused
Jul 15 15:50:49 mail postfix/amavis/smtp[888985]: 4R2v3v1m8fzCcfM: to=<root@mail.sohoono.com>, orig_to=<root>, relay=none, delay=44446, delays=44446/0.03/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10026: Connection refused)
Jul 15 15:50:49 mail postfix/error[889243]: 4R25vb0YVvzCccf: to=<anthony.cj@sohoono.com>, relay=none, delay=155742, delays=155742/0.05/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:49 mail postfix/error[889243]: 4R2YC837RvzCcdJ: to=<anthony.cj@sohoono.com>, relay=none, delay=92741, delays=92741/0.06/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:49 mail postfix/error[889243]: 4R2vrJ1P8LzCcfV: to=<anthony.cj@sohoono.com>, relay=none, delay=42345, delays=42345/0.05/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:49 mail postfix/error[889243]: 4R2vrG5NCVzCcfS: to=<anthony.cj@sohoono.com>, relay=none, delay=42347, delays=42347/0.06/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:50:49 mail postfix/error[889243]: 4R2m4R2Wp8zCcfC: to=<anthony.cj@sohoono.com>, relay=none, delay=63346, delays=63346/0.06/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
Jul 15 15:52:34 mail postfix/scache[889242]: statistics: start interval Jul 15 15:50:49
Jul 15 15:52:34 mail postfix/scache[889242]: statistics: domain lookup hits=0 miss=2 success=0%
Jul 15 15:52:34 mail postfix/scache[889242]: statistics: address lookup hits=0 miss=2 success=0%


So many login record in the last email from my postmaster account, it seems that my server had been attacked before, and I also attach my mail.log.

Please help me handle this problem, thanks a lot.

Post's attachments

mail.rar 226.31 kb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by Cthulhu

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 907

Re: My sub accounts can not receive emails, it was normal before thursday.

connect to 127.0.0.1[127.0.0.1]:10024: Connection refused

That's amavis port, so if the connection fails, amavis is not running (anymore)

3 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

Cthulhu wrote:

connect to 127.0.0.1[127.0.0.1]:10024: Connection refused

That's amavis port, so if the connection fails, amavis is not running (anymore)

I use 'service status amavis', it told me that amavis became error since Jul 12, and the output is in the attachment.


I had no operation on my email server before thursday, why did it become error since Jul 12?

What's my next step?

Thanks.

Post's attachments

service status amavis.txt 2.38 kb, 1 downloads since 2023-07-16 

You don't have the permssions to download the attachments of this post.

4 Reply by dave.opc

  • dave.opc
  • Member
  • Offline
  • Registered: 2019-07-08
  • Posts: 103

Re: My sub accounts can not receive emails, it was normal before thursday.

so what happens if you try to restart amavis service?

5 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

dave.opc wrote:

so what happens if you try to restart amavis service?

after restart, i start receiving email, but why is there still have error log in the output?

please check the attachment, thanks.

Post's attachments

service status amavis after restart.txt 2.51 kb, 2 downloads since 2023-07-16 

You don't have the permssions to download the attachments of this post.

6 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

dave.opc wrote:

so what happens if you try to restart amavis service?

after i restart amavis for 10 minutes, amavis change to inactive status again.

please check the attachment, thanks.

Post's attachments

service status amavis after restart for 10 minutes.txt 2.24 kb, 1 downloads since 2023-07-16 

You don't have the permssions to download the attachments of this post.

7 Reply by Cthulhu

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 907

Re: My sub accounts can not receive emails, it was normal before thursday.

there seems to be a problem with clamav aswell, did you manually upgrade it?

how much ram do you have?

8 Reply by sohoon (edited by sohoon 2023-07-16 23:44:01)

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

Cthulhu wrote:

there seems to be a problem with clamav aswell, did you manually upgrade it?

how much ram do you have?

no, i just execute 'apt update -y' and 'apt upgrage -y' before i execute 'bash iRedMail.sh' to install iredmail, after that i did not execute any upgrade command.

should i execute 'apt upgrade -y' to upgrade all apps? I am afraid that there will be problems happen after i upgrade all apps.

my server has only 1GB ram， and here is current status:

               total        used        free      shared  buff/cache   available
Mem:             964         522         178           2         263         301
Swap:           2399         456        1943

9 Reply by dave.opc

  • dave.opc
  • Member
  • Offline
  • Registered: 2019-07-08
  • Posts: 103

Re: My sub accounts can not receive emails, it was normal before thursday.

it's safe to upgrade the system with apt update / apt upgrade.
But 1Gb is too low, is it possible to increase to at least 2Gb?

10 Reply by Cthulhu

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 907

Re: My sub accounts can not receive emails, it was normal before thursday.

iredmail needs at least 4GB of ram, which is aswell written down on the install tutorial, so no wonder amavis crashes

11 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

dave.opc wrote:

it's safe to upgrade the system with apt update / apt upgrade.
But 1Gb is too low, is it possible to increase to at least 2Gb?

I've try to apt update / apt upgrade my server, bug nothing needs to upgrade.

I also update my server to 2GB, and i restart amavis for more than 10 times.

everytime i restart amavis, some emails from last week got received, but not all of them.
after i restart for over 10 times, nearly all delay emails got received, but amavis still dead after a while.(it lasts longer than the server is in 1GB ram. )

At the beginning, I thought that it was because there were to many emails blocking, so amavis still dead.
But after over 10 times restart, nearly all the emails got received, the situation did not take a turn for the better.

12 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

Cthulhu wrote:

iredmail needs at least 4GB of ram, which is aswell written down on the install tutorial, so no wonder amavis crashes

https://docs.iredmail.org/install.iredm … buntu.html
https://docs.iredmail.org/install.iredm … zh_CN.html

I found that in these two document, the ram that required is different.
In the zh_cn version, it required 2GB, and the other required 4GB.

Now my server had update to 2GB, but amavis still dead after a while, although it lasts longer than before.

Is there any idea to fix this problem in 2GB Ram?

13 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

dave.opc wrote:

it's safe to upgrade the system with apt update / apt upgrade.
But 1Gb is too low, is it possible to increase to at least 2Gb?

supply an attachment,

in the attachment,

the first part is copy from 'systemctl status amavis' after amavis dead,
the second part is from /var/log/mail.log, and the logs is around the last email that amavis received.

it seems there was no special error, so how can i confirm the reason that is the ram too small makes it dead or other reason?

Post's attachments

logs around dead.txt 11.88 kb, 1 downloads since 2023-07-18 

You don't have the permssions to download the attachments of this post.

14 Reply by Cthulhu

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 907

Re: My sub accounts can not receive emails, it was normal before thursday.

my guess is, amavis crashes with OOM, so thread gets shut down from system due to lack of system memory

there is a reason for the 4GB requirement

15 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

Cthulhu wrote:

my guess is, amavis crashes with OOM, so thread gets shut down from system due to lack of system memory

there is a reason for the 4GB requirement

I use top command, and i found that the mem is enough, still have nearly 300MB left.

But current amavis is active, maybe most time the mem is enough, and I guess it will use out all mem at some time when it going to be dead.

16 Reply by Cthulhu (edited by Cthulhu 2023-07-19 00:38:07)

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 907

Re: My sub accounts can not receive emails, it was normal before thursday.

amavis needs ram when actively scanning, thats just the background daemon, and if many concurrent mails get scanned, it needs even more ram

17 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

Cthulhu wrote:

amavis needs ram when actively scanning, thats just the background daemon, and if many concurrent mails get scanned, it needs even more ram

Can i limit it scan less email when actively?

I don't need to receive email as soon, finally i can receive it, that's enough.

18 Reply by Cthulhu (edited by Cthulhu 2023-07-19 01:08:57)

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 907

Re: My sub accounts can not receive emails, it was normal before thursday.

would you play a shooter with 10fps only just because ou dont meet the requirements?

19 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

Cthulhu wrote:

would you play a shooter with 10fps only just because ou dont meet the requirements?

No, I won't, maybe i should find a cheaper service provider that can provide 4GB server in lower price.

Thanks a lot.

20 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,082

Re: My sub accounts can not receive emails, it was normal before thursday.

sohoon wrote:

In the zh_cn version, it required 2GB, and the other required 4GB.

4GB is required, mostly required by ClamAV. zh_CN is not up to date.

21 Reply by sohoon

  • sohoon
  • Member
  • Offline
  • Registered: 2023-07-15
  • Posts: 12

Re: My sub accounts can not receive emails, it was normal before thursday.

ZhangHuangbin wrote:
sohoon wrote:

In the zh_cn version, it required 2GB, and the other required 4GB.

4GB is required, mostly required by ClamAV. zh_CN is not up to date.

OK, thank you very much. I'm going to upgrade my server to 4GB.