Troubleshooting
Problem
Checking and cleaning postfix mail queue, if emails have not been sent
Symptom
Emails being sent by rules or alerts might back up in the Postfix mail queue, if a system mis-configuration causes them to be undeliverable or a bad rule causes many emails to be generated. This can cause a high number of emails to be queued. This email volume, if not stopped at QRadar, might overwhelm a mail server.
Cause
Incorrect system configuration or misconfigured rule
Diagnosing The Problem
To confirm the Postfix that the mail queue is backed up, one of the following commands can be run from the command line while logged in as root:
- mailq
32CF02FE0E39 2173 Fri Dec 15 01:37:21 QRADAR@localhost.localdomain
(delivery temporarily suspended: connect to mail.example.com[192.168.130.233]:25: Connection refused)
no.one@example.com
10086 Kbytes in 3601 Requests. - postqueue -p
32CF02FE0E39 2173 Fri Dec 15 01:37:21 QRADAR@localhost.localdomain
(delivery temporarily suspended: connect to mail.example.com[192.168.130.233]:25: Connection refused)
no.one@example.com
10086 Kbytes in 3601 Requests.
Either of the commands show the sender, recipient, and ID of all messages queued in the Postfix system.
The commands can also be piped to less or redirected to a text file for easier reading and searching.
The ID can be used with the following command to view the actual message for a given queued mail:
- postcat -vq ID
Again, the above can also be redirected to a file to better read the mail.
Resolving The Problem
To delete all the messages in the queue, run one of the following commands:
- postsuper -d ALL
- postsuper -d ALL deferred
The 'deferred' option deletes messages that are marked for retry later. Depending on the scenario, both of the commands may need to be run to completely empty the queue.
If it is preferred to attempt to process (send/resend) the messages in the queue instead of deleting them, use one of the following commands:
- postqueue -f
- postfix flush
Where do you find more information?
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21984462