JERVIS DOT WS

Here is a quick HowTo / TechTip for deleting all the mail from an exim mail queue!

After the issue I blogged about the other day, where a webserver was being used to generate spam, we were left with a lot of spam email in the servers mail queue awaiting delivery.

Amongst other things, this was then causing a performance hit on the server sending messages. I decided that the few real emails in the queue were on no importance and to just delete the whole lot.

Chances are as a sysadmin, its a job you may have to do at some point. This is how I cleaned out the exim queue on the webserver and then the one on the outbound mail server.

First off, take a look at your queue:

[user@www user]# exim -bp
As the mail is spam we want to delete it, not empty the queue via SMTP as all the spam will sent to people and our server may be blacklisted.

Delete all the mail in the queue run:

[user@www user]# exim -bpru | awk {‘print $3′}
| xargs exim -Mrm > deletedmail.txt
We can now check how many mails were removed by running:

[user@www user]# wc -l deletedmail.txt
13416 deletedmail.txt
[user@www user]#
We have now deleted all 13416 mails in the queue and the server is as good as new. (Remember to fix the loop hole first, if you don’t you will soon have alot of spam in the queue again!)

The deletedmail.txt file will look something like this:

Message 1K3FYb-0000wH-CF has been removed
Message 1K3FYb-0000wH-6l has been removed
Message 1K3FYb-0000wH-3r has been removed
Message 1K3FYb-0000wH-1d has been removed
On the mail server, we want to remove all mail from the webserver only. To do this we modify the command line to grep for the sending address.

[user@mail user]# exim -bpru | grep “” |
awk {‘print $3′} | xargs exim -Mrm > deletedmail.txt
[user@mail user]# wc -l deletedmail.txt
73012 deletedmail.txt
[user@mail user]#
So we have now removed 73012 mails from the mail servers queue. This means in my example here, we have saved the internet from 86428 spam emails.

A few other useful exim queue commands include:

# exim -q # Flush waiting mail
# exim -qf # Flush all mail
# exim -qff # Flush even frozen mail
To remove frozen mail from the local spool, try this…

# exim -bpru | grep “*** frozen ***” | awk {‘print $3′} |
xargs exim -Mrm > deletedmail-frozen.txt

This is my quick guide to do an install and basic setup of exim on CentOS. This is not meant as a fully inclusive guide but it will get you on the way. Following this you should get a working exim install.

I will assume you have built a CentOS 4 / 5 Server, have yum working and have logged in as root.

You may want to make sure your up to date…
yum update

Install exim and mail switching tools
yum install exim
yum install system-switch-mail

Switch your MTA & set exim to start on boot
system-switch-mail
service sendmail stop
service exim start
chkconfig exim on
chkconfig sendmail off

Add a root alias, eg: “root: me@example.com”
vi /etc/aliases

You may also wish to add some config to your routers section like this, if you want to relay through a smart host.
vi /etc/exim/exim.conf

Then add this before the “dnslookup:” section.

to_smart_host:
driver = manualroute
domains = ! +local_domains
transport = remote_smtp
route_list = “* mail1.example.com:mail2.example.com;”

Restart exim
service exim restart

To test, send an email
echo “test” |mail -s “$HOSTNAME” me@example.com

Then you can flush the Exim Que and watch the log like this
exim -qff ; tail -f /var/log/exim/main.log

Good luck!