delivery queue monitoring

[homesh2009]

Hi

We wanted to monitor the delivery queue of our ironport boxes C350.

we got the below reply from support.
Hello Homesh,

The best I can suggest you, is to get the information from the CLI command "tophosts". If
you choose option 1 (Active Recipients) you will be presented a list of the Top-20 domains
that is having messages awaiting delivery.

You could e.g. make a SSH script that automates the running of the "tophosts" command, and
then have another script analyze the details for an automated alert.

Please be aware that since scripting is outside the scope of Cisco Ironport Customer Support,
I can not be of assistance with writing these scripts. I do though hope my suggestions gives
you enough to proceed on


Please help me in writing the scripts or if you have different solution for this.

Thanks in advance,
Homesh

[mychrislo_ironport]

And you want to monitor more than this? Can you elaborate?

Chris

[Akhil22]

I can develop the powershell script through which you can monitor the work queue, Memory, CPU and it will notify to you via mail if threshold value is exceeded. please contact to me on pintu2000@gmail.com 

[homesh2009]

Hi,

Thanks for reply.

We are monitoring other things like CPU,RAM,workqueue etc via snmp.
we want to monitor delivery queue and there is no OID for this hence the work around is suggested by Ironport tech support.

This is because if my downstream server is not accepting the connection Ironport delivery q get increase (we use qmail and some times main partition goes into readonly mode)


Thanks ,
Homesh Joshi

[u50861]

Hi Homesh Joshi/ Team,

I too working same kind of issue. could you please share the Inputs for the code development.

 Currently the only option is to monitor all the work queue ,there is a list of interesting OIDs for Email, but there is no specific for just the outgoing mail queue

Thanks,

Brahma

[mychrislo_ironport]

In fact, you may need a unix/linux. generate the ssh client public key and insert it into the ironport via cli

cli -> sshconfig -> new

Then paste your client key there.

I am sure the ironport support can get u here so far.

Then you get some initial screen just like tophosts from your unix/linux.


Being said that.

On the same subject, i find the output is garbled.
This seems to be a __bug__ to me.

Interactive screen looks like this


(Machine imsntiton.example.com)> tophosts

Sort results by:

1. Active Recipients
2. Connections Out
3. Delivered Recipients
4. Hard Bounced Recipients
5. Soft Bounced Events
[1]> 1

Status as of: Thu Dec 10 21:12:03 2009 HKT
Hosts marked with '*' were down as of the last delivery attempt.

Active Conn. Deliv. Soft Hard
# Recipient Host Recip. Out Recip. Bounced Bounced

1 zxgals.com 0 0 30 0 0
2 zxguy.com 0 0 3,406 0 6
3 zxifooba.com 0 0 43,203 1 59
4 zxifriends.com 0 0 1,286 0 1
5 zxiworld.com 0 0 8,749 0 10


6 zxtrade.com 0 0 35,255 11 139
7 example.com 0 0 7,908,720 815 8,148
8 lemonmoan.gicp.net 0 0 2 0 0
9 ibveatxeb.com 0 0 88 0 0
10 lovezx.com 0 0 25,908 0 41


11 the.euq.queue 0 0 0 0 0
12 the.euq.release.queue 0 0 0 0 0

(Machine imsntiton.example.com)> exit



Automated screen look like this.


# ssh statuser@imsntiton tophosts
Status as of: Thu Dec 10 21:12:12 2009 HKT
Hosts marked with '*' were down as of the last delivery attempt.

Active Conn. Deliv. Soft
Hard
# Recipient Host Recip. Out Recip. Bounced
Bounced

1 zxgals.com 0 0 30 0
0
2 zxguy.com 0 0 3,406 0
6
3 zxifooba.com 0 0 43,203 1
59
4 zxifriends.com 0 0 1,286 0
1
5 zxiworld.com 0 0 8,749 0
10


6 zxtrade.com 0 0 35,255 11
139
7 example.com 0 1 7,908,722 815
8,148
8 lemonmoan.gicp.net 0 0 2 0
0
9 ibveatxeb.com 0 0 88 0
0
10 lovezx.com 0 0 25,908 0
41


11 the.euq.queue 0 0 0 0
0
12 the.euq.release.queue 0 0 0 0
0

[Jason Meyer]

There is a xml status page that the appliances serve that we use to grab monitoring information with a windows application called curl.

If you navigate to:
https://your.ironport.host/xml/status
you can see the xml code.

Then with curl you can grab this information and store it in a file and then build a custom webpage to display whatever you want to monitor. Something like this:

curl -k -s https://your.ironport.com/xml/status -u userid:password > c:\ironport.xml

We created a read only userid for curl to use and have been happy with how it works.

[homesh2009]

In fact, you may need a unix/linux. generate the ssh client public key and insert it into the ironport via cli

cli -> sshconfig -> new

Then paste your client key there.

I am sure the ironport support can get u here so far.

Then you get some initial screen just like tophosts from your unix/linux.


Being said that.

On the same subject, i find the output is garbled.
This seems to be a __bug__ to me.

Interactive screen looks like this


(Machine imsntiton.example.com)> tophosts

Sort results by:

1. Active Recipients
2. Connections Out
3. Delivered Recipients
4. Hard Bounced Recipients
5. Soft Bounced Events
[1]> 1

Status as of:                   Thu Dec 10 21:12:03 2009 HKT
Hosts marked with '*' were down as of the last delivery attempt.

                                 Active  Conn.     Deliv.       Soft       Hard
#   Recipient Host               Recip.    Out     Recip.    Bounced    Bounced

1   zxgals.com                        0      0         30          0          0
2   zxguy.com                         0      0      3,406          0          6
3   zxifooba.com                      0      0     43,203          1         59
4   zxifriends.com                    0      0      1,286          0          1
5   zxiworld.com                      0      0      8,749          0         10


6   zxtrade.com                       0      0     35,255         11        139
7   example.com                       0      0  7,908,720        815      8,148
8   lemonmoan.gicp.net                0      0          2          0          0
9   ibveatxeb.com                     0      0         88          0          0
10  lovezx.com                        0      0     25,908          0         41


11  the.euq.queue                     0      0          0          0          0
12  the.euq.release.queue             0      0          0          0          0

(Machine imsntiton.example.com)> exit



Automated screen look like this.


# ssh statuser@imsntiton tophosts
Status as of:                   Thu Dec 10 21:12:12 2009 HKT
Hosts marked with '*' were down as of the last delivery attempt.

                                 Active  Conn.     Deliv.       Soft
Hard
#   Recipient Host               Recip.    Out     Recip.    Bounced
Bounced

1   zxgals.com                        0      0         30          0
0
2   zxguy.com                         0      0      3,406          0
6
3   zxifooba.com                      0      0     43,203          1
59
4   zxifriends.com                    0      0      1,286          0
1
5   zxiworld.com                      0      0      8,749          0
10


6   zxtrade.com                       0      0     35,255         11
139
7   example.com                       0      1  7,908,722        815
8,148
8   lemonmoan.gicp.net                0      0          2          0
0
9   ibveatxeb.com                     0      0         88          0
0
10  lovezx.com                        0      0     25,908          0
41


11  the.euq.queue                     0      0          0          0
0
12  the.euq.release.queue             0      0          0          0
0

Thanks for your help.
using above mention things Now we have written script in our LINUX server which periodically check (cron) if the active recipient are >100 and sends us alert on our mobile.

Gr8 job.

Thanks for your valuable suggestion.

Regards,
Homesh

[homesh2009]

There is a xml status page that the appliances serve that we use to grab monitoring information with a windows application called curl.

If you navigate to:
https://your.ironport.host/xml/status
you can see the xml code.

Then with curl you can grab this information and store it in a file and then build a custom webpage to display whatever you want to monitor.  Something like this:

curl -k -s https://your.ironport.com/xml/status -u userid:password > c:\ironport.xml

We created a read only userid for curl to use and have been happy with how it works.

Hi ,

we wants to get the ip addresses from Monitor -> outgoing sender page.
from here we will update a local RBL for any of the IP sending more than 50 spam.
we will then write a message filter which will query this local RBL.

This is important for us as we are an ISP setup.

Please guide how to fetch that table "Sender Details" which gets displayed in outgoing sender page.

Thanks in advance,

Regards,
Homesh

[mychrislo_ironport]

i think you will need the apireport tool (contributed tools) in support area of ironport.

i tried a little there. but it is not working in my setup yet (they are written in perl).

those are not too recent (year 2007), but i guess it should easily be fixed.

[shannon.hagan]

Use any language that can get webpages and look at the results and use the http://myironport.com/xml/tophosts page and parse the xml results.  You would also be able to total multiple machines if there are any.

[mychrislo]

wow...this is nice trick! any other xml/ pages?

[shannon.hagan]

Yes.

Status	Page
Mail status	http://hostname/xml/status
Mail status for a specific host	http://hostname/xml/hoststatus?hostname=host
DNS status	http://hostname/xml/dnsstatus
Top incoming domains	http://hostname/xml/topin
Top outgoing domains	http://hostname/xml/tophosts

I use a bash script and curl to combine data from multiple pages and display it on a status page so we see a quick view of the IronPorts or if some domain has decided not to take or mail.

[homesh2009]

Hi,

Can please let me know the URL for outgoinf senders.

I am trying /xml/internal_senders but it is not working.

I want to get the top ten IP address from which I recieved outgoing spam.

Ours is ISP set up hence this is very importatnt for us to know which all our customers acting as zombi.

Thanks in advance.

Homesh