Wednesday, March 5, 2008

How to clean Exim's Mail queue

How to clean an Exim queue

* How to clean an Exim queue
o Using WebHost Manager
o Advanced Users
o Very Advanced Users

Using WebHost Manager

1. Login to WHM.
2. On the Main page, click on the email icon:
3. In the mail menu, select "Manage Mail Queue":
* Note: Instead of steps 2 and 3, you can select "Manage Mail Queue from the left margin:
4. Find the message you wish to delete and select "Delete":

Advanced Users
WARNING: The information below is intended for users with advanced knowledge of operating systems, control panels, and other aspects of server management. Do NOT simply copy and paste commands to resolve issues as you may severely harm your server, cause downtime, or incur billable support not covered under your DEFCON plan. Please open a support ticket if you feel uncomfortable with the suggestions provided.

There are many times when a mail queue may become filled with what is essentially junk mail. At extreme levels, this can cause high load and delayed mail delivery.
You can use a variation of the following command via a shell prompt to delete only these junk messages from the mail queue:

grep -lR KEYWORD /var/spool/exim/input/* | xargs rm -f

This will purge the mail queue of any messages that contain KEYWORD.
Any messages deleted in this manner are IRRETRIEVABLE (aka: Gone for good)
Is this dangerous? You bet it CAN be. If you have any doubts, open a support ticket.

Let's look at an example.
Imagine a case in which users are abusing a bad FormMail.pl installation on server.fastservers.net. Almost all of these messages will contain the username "nobody@server.fastservers.net". We want to delete ALL of these messages, so we would insert "nobody@server.fastservers.net" in place of "KEYWORD" in the command above.
This will delete all messages in the exim queue that contain the keyword "nobody@server.fastservers.net".

Very Advanced Users
Grep does regular expressions. This means you can catch tricky spammers with a little mind power. For example:

grep -lRP Vz*Az*Lz*Iz*Uz*M /var/spool/exim/input/* | xargs rm -f

This command will delete any message containing the letters V, A, L, I, U, M, in that order, and with 0 or more "z" characters between them. A few of the keywords it will match are listed:
VALIUM
VzALIUM
VAzLIzUzM
VALzIUM
VzALzIUM
You get the idea.

No comments: