I think you may be worrying about the wrong part the problem. You need to understand WHY the message are being queued. You likely have either
- network interface not working as required
- a mail route not working
- DNS not working - you can deliver mail outbound if you can't resolve the recipient domains MX record and the A records of the servers listed.
- A brightmail component is hung.
I have five (5) 8380 scanners in my configuration and I RARELY have more than a few hundred message in any of the delivery queues. Almost all of these are due to incorrect e-mail address (someone used Bob@tahoo.com instead of bob@yahoo.com
A quick way to check queue level is under Status, System, Hosts, then the Message Queues tab.
There are three queues in Brightmail.
Inbound - this handles mail arriving from the internet destined for the domains you are responsible for.
Outbound - this handles mail arriving from your internal systems destined to the internet.
Both these queues next hand messages to the internal brightmail processes (spam, antivirus, content policies, etc). A large message queue say more than 10-20, and growing, means some brightmail processes has failed. My first debug step would be to restart the MTA.
Delivery queue - this queue takes message that have been processed by brightmail's filters and are OK to be delivered to the recipient (external or internal). You need to look at WHY the messages are in the queue.
To do this, go to Status, Hosts, Message Queues
- Select the host with the high queue.
- Select the queue with the high queue.
- leave the others at the default.
- change the list "25 in the queue longest" to "100 in the queue longest" to get a good sample.
- click Display filtered.
- once the list is displayed, click the Error (or Last Error in v10) to sort the message by failure code.
- figure out the issue - too long to go into here.
Now to your questions
Q: I am getting an alert "The combined message queue for the following Scanners is larger than 1048576 KB"
A: that means that you have reached a queue size greater than the alerting level configured. This is the total size of all the messages in the queue, not the number of messages. A GB of messages is probably a lot of messages unless you allow big attachments.
You can see this limit setting (1 GB) by going to Administration, Settings, Alerts. Click the Queues tab. I recommend you DO NOT CHANGE this value unless it is to DECREASE it.
Q:I would like to know if it is getting full then is it overwriting the queue or no new messages are logged in queue?
A:If the scanner runs out of disk space to queue the messages, new message arriving will be rejected. Probably with a 4xx series failure code. I've never run into this case, and I've had scanners with 150,000 messages queued.
If you look at your scanner configuration by
- going to Administration, Hosts, Configuration.
- Pick a Scanner.
- click on the SMTP tab.
- click on Advanced at the lower left.
On each of the direction tabs (inbound, outbound, delivery), there is a line that reads "Maximum number of messages in xxxx queue:"
Once this number of message are queued any new message arriving will be REJECTED.
The defaults are Inbound - 5,000; Outbound - 5,000; and Delivery - 150,000.
If you reach these limits you have something VERY SERIOUSLY BROKEN in your configuration, or you have been blacklisted.
Q: I would like to know the maximum combined message queue that appliance can handle?
A: There are two limits - the limit set by the "Max # of message in xxx Queue" setting discussed above, and the total disk space used by the queued messages. Each e-mail in the queue has a database record and a disk file containing the actual message. How many can be stored depends the size of the messages, and the size DATA partition on your appliance.
To check how much space you have go to Status, Hosts, Hardware Information. The total disk space is listed in the rightmost column. My 8380 has 836 GB of disk space. Next click the Hardware Status tab. About in the middle is listed the "Disk Usage". That's -roughly- the amount of space in use by brightmail
Q: Is it possible to schedule to automatically delete the queues more than 7 days?
A: The default behavior of e-mail systems pretty much since they were invented is to
1. warn the sender if there is a problem delivering e-mail. The default on Brightmail is to start doing this after 4 hours in the queue.
2. if the system gives up, tell the sender that delivery was not possible. Brightmail defaults to doing this after 5 days of trying. When it gives up, it sends a notice to the sender, and the message is deleted from the queue. In other words, brightmail will delete items from the queue after 5 days, and tell the original sender that it did this.
These are reasonable defaults. Don't change them without reason. In my configuration, I have brightmail stop trying after 3 days, because my users like knowing there is a problem soon.
This is configured on EACH scanner on the STMP, Advanced, Delivery tab, in the setting "Sent message time-out:"
Q: Is it recommended to delete the message queues?
A: Queued messages are automatically deleted, and the sender notified, as discussed in the previous question. There are few situations where deleting queued messages is appropriate. Remember that if you do this the sender will not be told the message was not delivered. This is not polite.
The only time I deleted messages from the delivery queue is if I know that they were sent in error or maliciously.
Examples - someone sent mail to many people but typed the incorrect domain name; or someone's PC was infected and it sent a lot of spam which is clogging the delivery queue.
Q: I would like to know if it is getting full then is it overwriting the queue or no new messages are logged in queue?
A: if the limits of the queue are reached, messages are rejected. The user would normally get a message from his e-mail server (say Exchange) that the message could not be sent.
Q:I would like to know the maximum combined message queue that appliance can handle?
A:As mentioned above, the default configuration is 150,000 in the delivery queue. But you could configure the appliance to queue many more, only limited by the appliance disk space. This would not be wise.
Q:Is it possible to schedule to automatically delete the queues more than 7 days?
A:As discussed above, the default is to delete messages from the queue at 5 days. You can change this in each scanner under SMTP, Advanced. Increasing this to 7 days may confuse your users, and get them in trouble. For example if they send a message to a customer but mistype the domain, it will be 7 days before they find out about their error. Meanwhile the customer is getting impatient waiting for the e-mail.
Q:Is it recommended to delete the message queues?
A:Only under unusual circumstances. A well configured brightmail system will not have large queues.
Q: "Scanner will stop accepting mails" Does that means it will drop that mails which are coming in queue including genuine mails.
A: it will REJECT mails. It is the responsibility of the sending mail server to tell the sender of the problem. Brightmail can not tell if an e-mail is genuine until it processes it. It can't process it if there is no room in the queue.
Q: How to check how long messages are allowed to stay in the queue?
A: see Admin, Hosts, Configuration, pick a scanner, SMTP tab, Advanced, then the Sent message time-out: setting.
If you are having queue issues, you have a configuration issue (route), DNS (unable to resolve domains), or network issue.
If this answers your question, please mark this as a solution.