Hey Tony,
I know this may not be the ideal response, but I would indeed like to recommend to open a case if the issue is present so we can review it for you; as with a case and tunnel access we can check what is in the workqueue and causing the problem.
However if that's not possible, some useful grep commands i would suggest to monitor the amount of emails or types (perhaps there is a large influx of a particular email coming in at these specific times that can be mitigated).
From the CLI:
grep “MID.*Subject” mail_logs
This will return outputs of all new message and their subject in an individual line for easier troubleshooting and less clutter for log reviewing
grep “ready” mail_logs
This command will return outputs of all emails which has been fully accepted for workqueue processing with the sender of the email in question
grep -i “new smtp icid” mail_logs
This command is extremely useful to see if you’re being attacked by a common sending address who is spamming your system that you do not trust, buy locating the common sender IP, you can add them directly to the BLACKLIST to reject it at the connection point
tophosts
This is to show the emails in your delivery queue and notice if there is any hosts which generally has a lot more emails than others
showrecipients
This will show you the emails for that host in more detail such as subject, sender, MID, and how many retries of delivery.
Perhaps there is a large amount of emails you're not actually meant to be receiving and this may be the one impacting your queue.
Once more details are known, you can then start using either message filters to remove invalid emails at the workqueue level based on your gathered information.
To diagnose if your services may be having some form of failure, checking the mail_logs to see which process is taking more time than other (or message tracking) can give an indicator.
Regards,
Matthew
