000031674 - DLP Connection throttling on MTA for Interceptor outgoing email

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000031674
Applies ToRSA Product Set: DLP
RSA Product/Service Type: Data Loss Prevention, Network
RSA Version/Condition: 9.6, 9.6 SP2
Platform: CentOS
O/S Version: EL6
IssueConnection throttling on MTA for Interceptor outgoing email. MTA running on the Interceptor is Sendmail. there are throttling control available on the MTA level and on Interceptor.
Smarthostmaxconnection in nwsystemconfiguration.xml on Interceptor limits the number of connections to outgoing MTA. However, it is possible to get into situation where too many Sendmail processes are processing queues. These queue processors are children of the mail Sendmail process. If there are more than 20 connections observed at a time then MTA throttling can be controlled via this Sendmail M4 variable  "confMax_queue_children". 
MTA throttling
M4 variable: MaxQueueChildren

Limits the maximum number of concurrent queue runners active. This is to keep system resources used within a reasonable limit. 
Interceptor throttling
nwsystemconfig.xml configuration: smarthostmaxconnection
By default the value is set at 20, this is the maximum smarthost connection on the Interceptor

 
Tasks
Resolution
  1. Log on to the Interceptor with tablus user. 
  2. From the tabmenu Exit to the shell window by selecting option 6)  Advanced.
  3. Then select option 1)  Exit to Shell from the tabmenu.
  4. Change directory to /opt/tablus/config/sendmail/mail-out.
  5. Edit the sendmail.mc file. 
Add the following M4 variable define(`confMAX_QUEUE_CHILDREN', `num') into the Sendmail configuration to limits the maximum number of concurrent queue runners for outgoing email on the Interceptor.
Use a suitable number as it will reduce the number of children running on mail-out queue which eventually reduce connections. Replace num with the appropriate value. 
Important Note: Ensure the appropriate grave accent symbol is used ( ` ) at the beginning of the variable and single quote ( ' ) at the end of the variable.
An example setting provided below. 


define(`confMAX_QUEUE_CHILDREN', `20')


  1. Save the chance to the Sendmail.mc
  2. Restart Interceptor for the configuration change to take effect

moncmd restart interceptor

Attachments

    Outcomes