Users complain of missing emails

Submitted by uinfor on Wed, 11/05/2014 - 05:25 Pro Licensee

Users complain of missing emails

For weeks I have been getting complaints from my clients that detect there emails do not arrive directly lost and not reach their mailboxes and send it receives no mail, no error code First I thought of the user who sent the mail had made ​​a mistake but when he sent a copy to another external mail coming to this client and no, I begin to suspect a serious server problem.

The question is where to start looking not ??

I have System CentOS Linux 5.11 Webmin version 1.710
Virtualmin version 4.11 Pro Theme version 8.7
Kernel and CPU Linux 2.6.18-398.el5 on x86_64
CPU load averages 0.31 (1 min) [CPU load (1 min)] 0.37 (5 mins) [CPU load (5 mins)] 0.45 (15 mins) [CPU load (15 mins)]

Status: 
Active

Comments

Submitted by andreychek on Wed, 11/05/2014 - 09:01

Howdy -- what you may want to do is to look at one of the emails that was sent to another service, and get the date/time from the email header that it was sent.

Using that information, look in your mail logs in /var/log/maillog at that same time, and see if you can see an incoming connection attempt.

If so, what happens to the email at that point?

Submitted by uinfor on Wed, 11/05/2014 - 10:29 Pro Licensee

Here you go one log email that I fail, and NOT Receive

Nov  4 12:56:47 hosting postgrey[4149]: action=pass, reason=client whitelist, client_name=nm38-vm8.bullet.mail.ir2.yahoo.com, client_address=212.82.97.158, sender=correo@yahoo.es, recipient=marisa@correo.com
Nov  4 12:56:47 hosting postfix/smtpd[4988]: E97D021C05C7: client=nm38-vm8.bullet.mail.ir2.yahoo.com[212.82.97.158]
Nov  4 12:56:48 hosting postfix/cleanup[15008]: E97D021C05C7: message-id=<567208349.608198.1415102205947.JavaMail.yahoo@jws11138.mail.ir2.yahoo.com>
Nov  4 12:56:48 hosting postfix/cleanup[19622]: D907921C05B7: message-id=<44F06F005D9D41DBA8EDA1C6C9E84123@eqeeepc>
Nov  4 12:56:48 hosting postfix/qmgr[5047]: D907921C05B7: from=<info@correopru.com>, size=6772, nrcpt=1 (queue active)
Nov  4 12:56:49 hosting postfix/qmgr[5047]: E97D021C05C7: from=<correo@yahoo.es>, size=346413, nrcpt=1 (queue active)
Nov  4 12:56:49 hosting postfix/smtpd[4988]: disconnect from nm38-vm8.bullet.mail.ir2.yahoo.com[212.82.97.158]
Nov  4 12:56:49 hosting postfix/smtp[20126]: D907921C05B7: to=<correo@telefonica.net>, relay=tnetmx.telefonica.net[86.109.99.69]:25, delay=1.9, delays=1/0/0.69/0.2, dsn=2.0.0, status=sent (250 <539F178807059F03> Mail accepted)
Nov  4 12:56:49 hosting postfix/qmgr[5047]: D907921C05B7: removed
Nov  4 12:56:50 hosting spamd[526]: spamd: connection from hosting.myserver.com [127.0.0.1] at port 56225
Nov  4 12:56:50 hosting spamd[526]: spamd: setuid to marisa.correo succeeded
Nov  4 12:56:50 hosting spamd[526]: spamd: processing message <567208349.608198.1415102205947.JavaMail.yahoo@jws11138.mail.ir2.yahoo.com> for marisa.correo:544
Nov  4 12:56:51 hosting postfix/smtpd[15002]: disconnect from 221.Red-88-25-56.staticIP.rima-tde.net[88.25.56.221]



Nov  4 12:56:58 hosting postfix/smtp[20126]: 8855F21C05BE: to=<mailreturn@smtp.ymlp44.net>, relay=none, delay=7631, delays=7630/0/0.21/0, dsn=4.4.1, status=deferred (connect to smtp.ymlp44.net[85.158.212.100]: Connection refused)

Nov  4 12:56:58 hosting dovecot: POP3(info.correo): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0
Nov  4 12:56:58 hosting spamd[526]: plugin: eval failed: bayes: (in learn) locker: safe_lock: cannot create lockfile /var/spool/mqueue/.spamassassin/bayes.mutex: Permiso denegado

Nov  4 12:56:58 hosting spamd[526]: spamd: clean message (0.0/3.0) for marisa.correo:544 in 8.5 seconds, 342137 bytes.
Nov  4 12:56:58 hosting spamd[526]: spamd: result: . 0 - FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,T_DKIM_INVALID,T_FREEMAIL_DOC_PDF scantime=8.5,size=342137,user=marisa.correo,uid=544,required_score=3.0,rhost=hosting.myserver.com,raddr=127.0.0.1,rport=56225,mid=<567208349.608198.1415102205947.JavaMail.yahoo@jws11138.mail.ir2.yahoo.com>,autolearn=unavailable
Nov  4 12:56:58 hosting dovecot: pop3-login: Login: user=<lloguers.correo>, method=PLAIN, rip=::ffff:217.126.82.51, lip=::ffff:192.168.100.53
Nov  4 12:56:58 hosting postfix/local[15024]: E97D021C05C7: to=<marisa.correo@hosting.myserver.com>, orig_to=<marisa@correo.com>, relay=local, delay=11, delays=1.5/0/0/9.4, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)

Nov  4 12:56:58 hosting postfix/qmgr[5047]: E97D021C05C7: removed
Nov  4 12:56:58 hosting spamd[4131]: prefork: child states: BB
Nov  4 12:56:58 hosting spamd[526]: spamd: connection from hosting.myserver.com [127.0.0.1] at port 56230

Submitted by andreychek on Wed, 11/05/2014 - 10:30

I see a few incoming emails in those logs... what From address in particular is it that you aren't receiving?

Submitted by andreychek on Wed, 11/05/2014 - 10:51

It looks like an email for that user was received and delivered to that user.

It's possible it's in the spam folder.

What you may want to do though is look in /var/log/procmail.log, which will show where exactly it was delivered.

Submitted by uinfor on Wed, 11/05/2014 - 10:55 Pro Licensee

I not view anything more about this mail, and the mail has not receive in the mailbox, and not in the spam folder

Do you see these errors ??? ->

Nov 4 12:56:58 hosting postfix/smtp[20126]: 8855F21C05BE: to=mailreturn@smtp.ymlp44.net, relay=none, delay=7631, delays=7630/0/0.21/0, dsn=4.4.1, status=deferred (connect to smtp.ymlp44.net[85.158.212.100]: Connection refused)

Nov 4 12:56:58 hosting dovecot: POP3(info.correo): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0 Nov 4 12:56:58 hosting spamd[526]: plugin: eval failed: bayes: (in learn) locker: safe_lock: cannot create lockfile /var/spool/mqueue/.spamassassin/bayes.mutex: Permiso denegado

Submitted by andreychek on Wed, 11/05/2014 - 11:01

Well, while SpamAssassin did throw an error, immediately after that is this delivery notification:

Nov 4 12:56:58 hosting postfix/local[15024]: E97D021C05C7: to=<marisa.correo@hosting.myserver.com>, orig_to=<marisa@correo.com>, relay=local, delay=11, delays=1.5/0/0/9.4, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME) ` That shows marisa@correo.com receiving an email from the sender "correo@yahoo.es", which is what you mentioned you were seeing a problem with.

Since it was sent to procmail-wrapper, that means it was delivered to that user on your server. There should be some additional logs about that delivery in /var/log/procmail.log.

Are you saying you aren't seeing that mentioned in /var/log/procmail.log though?

Submitted by uinfor on Wed, 11/05/2014 - 11:38 Pro Licensee

Ok, but in procmail.log only can i see today 5-11-2014, but in other compressed procmail.log.gz when i open from my windows machine (Winscp) i only see strange characters as if they were protected like this -> ¿???¿?

Ç6+0B>—p€–bÎ#} Ä÷ô%olSÏ—HTCúr¨FB.RCÑPPÉñrÎf/,GwˆÍ9ŽïAŽÚלBÁÁâû‰

Submitted by uinfor on Wed, 11/05/2014 - 11:55 Pro Licensee

I'm sorry, finally i can view procmail.log, here you are ->

From correo@yahoo.es  Tue Nov  4 12:56:49 2014
Subject: Factura minutas
  Folder: /home/correo/homes/marisa/Maildir/new/1415102218.21 342338
Time:1415102218 From:correo@yahoo.es To:correo@dstageconcept.com User:marisa.correo Size:342394 Dest:/home/correo/homes/marisa/Maildir/new/1415102218.21269_0.hosting.myserver.com Mode:None

Submitted by andreychek on Wed, 11/05/2014 - 12:03

Well, I have good news and bad news :-)

The good news is that the log information you found shows the email being delivered to the inbox of the user "marisa", in this directory:

/home/correo/homes/marisa/Maildir/new/

The bad news though is that since it was delivered there, it looks like the problem may be on your users end... perhaps with their email client.

The email client itself may have done something to the message, or filtered it in a way that's preventing them from seeing it.

It doesn't look like there's a problem with your server's email setup though, that all appears to be working properly.

Submitted by uinfor on Wed, 11/05/2014 - 12:18 Pro Licensee

Yes, but i have more than 50 domains and the last two or three weeks multiple users of diferent domains say me the same, some emails are lost

The first user i think problem user but several users say the same .... :-(

Submitted by andreychek on Wed, 11/05/2014 - 12:58

Unfortunately, there's not much we can do if it's showing the email being delivered to their inbox.

Are there other examples we could go over? Maybe we could find an issue with a different message to a different user.

Submitted by uinfor on Wed, 11/05/2014 - 13:01 Pro Licensee

Thankyou andreychek, I'll put new bugs in the future