Jim,
To prevent this from happening in the first place, you'll need to restrict
SMTP relaying. Use the CHGSMTPA command to change the allow relay setting
from *ALL to *LIST. Then, create an accept entry for your AS400 using the
ADDSMTPLE command. For example, if the IP address of your system is
10.1.1.1, then run the command:
ADDSMTPLE TYPE(*ACCEPT) INTNETADR('10.1.1.2')
SUBNETMASK('255.255.255.255')
This will allow your AS400 to send mail, but nobody else. Once this has
been set up, end the SMTP server and restart it.
If high activity continues, then end the SMTP server again and run the
following command:
CRTDTAARA DTAARA(QUSRSYS/QTMSCLEAN) TYPE(*CHAR) LEN(1)
VALUE('C') AUT(*ALL)
Then, start your SMTP server one more time. At this point, any pending
messages that the server was continuing to try and send will be cancelled.
Rich Loeber
Kisco Information Systems
http://www.kisco.com
--------------------------------------------------------------------------
Jim Waymire wrote:
Rich,
I shut down the smtp server, and the usage drops as you state. How do I
determine what is using it and fix or restrict it? Right now I am
running
at .4 as compared to about 64. When I restart it, it goes back to high
usage.
Jim Waymire
Tallyho Systems, Inc.
I agree with others that a spammer has commandeered your server and is
relaying
mail through it. You won't see any mail traffic locally, but the high
utilization in these jobs is a clear indicator. I've had this happen to
me.
You can proove it by shutting down SMTP (command: ENDTCPSVR *SMTP) for
a
little while and see if the problem goes away. If this is it, then you
will
have to reconfigure SMTP on your system to only allow limited relaying.
Rich Loeber
Kisco Information Systems
http://www.kisco.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at
http://archive.midrange.com/midrange-l.
midrange.com
