The mailing list for listmasters using Sympa

[Nick Holden <address@concealed>]

Hi all,

In recent days the amount of spam coming to our sympa server seems to
have increased significantly, partly because some spammer has decided to
spoof our sympa address in their spam, so the server is getting
non-delivery reports.

One of the results of this is that bounced.pl is repeatedly trying to
process bounce messages, including some which have no valid email
address in them. The logs show lines like:

Jul 15 09:14:45 theweaa1 bounced[11105]: error: no address found in
message from  for list ius 
Jul 15 09:14:45 theweaa1 bounced[11105]: Cannot
create /address@concealed/OTHER/ 
Jul 15 09:14:49 theweaa1 bounced[11105]: error: no address found in
message from  for list iufit 
Jul 15 09:14:50 theweaa1 bounced[11105]: Cannot
create /address@concealed/OTHER/ 
Jul 15 09:14:50 theweaa1 bounced[11105]: error: no address found in
message from  for list ius 
Jul 15 09:14:50 theweaa1 bounced[11105]: Cannot
create /address@concealed/OTHER/ 
Jul 15 09:14:54 theweaa1 bounced[11105]: error: no address found in
message from  for list iufit 
Jul 15 09:14:55 theweaa1 bounced[11105]: Cannot
create /address@concealed/OTHER/ 

It seems to be just those same two lists receiving either the same
message over and over, or many messages. As it is just those two lists,
I fear that there is some kind of loop of the same messages going over
and over. 

Whatever it is starting to have an impact on server resources. Sympa,
the task-manager and bounced.pl are starting to be the major drains on
the system, which they haven't been up until now...

Tasks: 131 total,   4 running, 126 sleeping,   0 stopped,   1 zombie
Cpu(s): 91.5% us,  6.6% sy,  0.0% ni,  0.0% id,  1.2% wa,  0.2% hi,
0.5% si
Mem:   1035848k total,   980228k used,    55620k free,    20324k buffers
Swap:  4008120k total,    98736k used,  3909384k free,   346192k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+
COMMAND                                                                       
                                                          
11094 sympa     25   0 77136  68m 9.9m R   52  6.8   6:51.31
sympa.pl                                                                      
                                                          
11275 www-data  15   0 41860  18m  27m S   33  1.8   9:09.31
apache                                                                        
                                                          
11109 sympa     15   0 84592  75m 9.8m S   33  7.5   1:16.51
task_manager.pl                                                               
                                                          
12991 sympa     22   0 43280  37m 8028 R   32  3.7   0:35.49
perl5.8.8                                                                     
                                                          
13011 www-data  15   0 31904 9.9m  25m S   11  1.0   0:01.91
apache                                                                        
                                                          
11105 sympa     16   0 29392  21m 9.8m S    0  2.2   0:03.14
bounced.pl                                                                    
                                                          
13210 root      16   0  2288 1172 1880 R    0  0.1   0:00.03
top            

Can anyone suggest (a) what is happening here, and (b) what I should do
to stop it? If it is the same two messages going round and round, can I
get them out of the 'bounced.pl' queue somehow?

This is a sympa installation which has been working excellently for a
long time up until this point.

Thanks,

Nick