[RESOLVED] Mail server stops sending and receiving emails

EDIT: [RESOLVED] Server did not have enough memory to handle the antivirus system - see the thread for details.
TL;DR: DO NOT operate ISPConfig 3 on server with less than 2 GB of RAM and 2 GB swap.

Hello Team,
I have installed my server some years ago using this howto:
https://www.howtoforge.com/tutorial...ix-dovecot-mysql-phpmyadmin-rkhunter-binutils
The server itself is actually Debian 8.11

I think it's it's irrelevant but let me say that for emails I use Thunderbird with SOCKS5 proxy set to 127.0.0.1 - the proxy itself is fine as emails sent via servers other than server1.mydomain.com work fine. I don't use TOR or any other frowned upon network as SOCKS5 proxy.

The issue:
My server suddenly stops receiving emails - at this point I can't be sure if it's really 100% of them but it was at least 90%.
From the 3rd party the sent email looks like this (this is what they received after couple of days since they sent the email):
Subject: Undelivered Mail Returned to Sender
Body:

Temporary fix:
Reboot of the server.
If I reboot the server the emails that could not be delivered and are in queue at the 3rd party servers (I assume) and are eventually coming through over the next couple of hours.

What I checked:
Disk space and host utilization.
Server has gigabytes of SSD space available and there is enough RAM as well as space in swap available, CPU utilization is low.

What I also noticed:
It seems that the issue goes both ways - at least in one case a sent email from server1.mydomain.com has been also bounced by Gmail, however this might be caused by reputation downgraded by some blacklists as my emails were bouncing (checked with mxtoolbox.com - the server IP already made it to the blacklist for reason of too many bounced emails):
Subject: Undelivered Mail Returned to Sender
Body:

This issue has already happened maybe 3 months ago but I did the reboot and forgot about the issue now the issue is back
I really don't know what to check or how to even diagnose this.
Thank you very much in advance for any help.

 

Is there any way to monitor for this or to auto-restart the service? Would removal of amavisd also disable the antispam or only the antivirus?

 

Can you please guide me what am I exactly looking for?
I suppose once I start seeing in the mail.log the following:

Code:

Jun 18 06:16:06 server1 postfix/smtp[3542]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused

(1) Then it's already broken - correct? But what shall I see beforehand?
(2) And am I looking for it in the mail.log or syslog?

 

ok in syslog I found the following:

Code:

Jun 18 06:09:30 server1 amavis[1750]: (!)Net::Server: 2019/06/18-06:09:30 Bad fork [Cannot allocate memory]\n  at line 145 in file /usr/share/perl5/Net/Server/PreForkSimple.pm

I suppose that's the error we are looking for?

The truth is the server is RAM starved - it has only 1 GB of RAM but it has 2 GB in swap which AFAIK is not full. Is there any way to make it work with the swap or just forget it and go ahead with upgrading the RAM?

 

Thank you till - you have been very helpful. I'm going to do the upgrade to 2 GB.

 

AFAIK is not good enough. Check how much memory and SWAP is used, for example with

Code:

free -h

or monitor with dstat (needs to be installed first)

Code:

dstat  --load --mem -s 10 100

If both RAM and swap are exhausted, you get out of memory errors. Adding swap is easy, make it 4 G or make another 2 G swap in addition to the one you have now, that gives more usable memory.