What does a Nagios Exim queue CRITICAL alert mean?

A Nagios Exim queue CRITICAL alert means the number of emails waiting in your server's mail queue has gone above a threshold set in the monitoring configuration. Mail is usually waiting because it cannot be delivered yet. A short rise can clear on its own, but a queue that keeps growing usually needs action.

This article explains what the alert means, how to check the queue, and how to reduce it. Some steps need SSH access as root, which is not available on shared hosting. For those steps, contact Hostking support.

What the alert means

Nagios is a monitoring tool. It runs checks on a server at regular intervals and sends a notification when a check reports CRITICAL.

Exim is the mail server software that handles outgoing and incoming email. Messages that Exim cannot deliver straight away are kept in a queue. The Nagios check counts the messages in this queue.

The alert text usually looks like CRITICAL - exim queue size, followed by the number of messages. The threshold is set in the monitoring configuration, so the trigger point can differ between servers.

A large queue usually means mail is not leaving the server. Common causes are:

• Spam sent from one email account or script.
• Remote mail servers rejecting or delaying messages.
• DNS problems, such as failed lookups for the recipient's mail server.
• Frozen messages that Exim has stopped trying to deliver.

Two terms are useful when you read the queue:

• Deferred: Exim will keep retrying these messages automatically.
• Frozen: Exim has given up trying to deliver the message. Frozen messages do not retry until someone removes or releases them.

Steps to take when you receive the alert

1. Copy the full alert text, including the word CRITICAL and the number shown.
2. Note the date and time the alert was sent.
3. Check whether you have recently sent a bulk email, added a contact form or changed your email settings.
4. Check whether your website and email still work normally.
5. If the alert is not repeating, wait 10 to 15 minutes and check again.
6. If the alert repeats, or you see unexpected outgoing mail, contact Hostking support as described below.
7. Send the exact alert text, the time, and the queue count to support.

Checking the mail queue

Your control panel may show the queue. If you have SSH access as root, you can also check it from the command line.

cPanel

1. Log in to cPanel using the details in your welcome email. If you cannot find them, use the client area at https://my.hostking.host.
2. In the search box, type "Mail Queue" and open the page that shows the queue, if it is available on your plan.
3. Note how many messages are waiting, and any sender or recipient that appears many times.
4. Send these details and the alert text to support.

DirectAdmin

1. Log in to DirectAdmin using the details in your welcome email. If you cannot find them, use the client area at https://my.hostking.host.
2. Check for any notices on the main page.
3. Note any recent changes to your email accounts, scripts or site.
4. Send these details and the alert text to support.

Command line (SSH as root)

Use these commands only if you have root access. Run them before you remove anything.

1. Count the messages in the queue: exim -bpc
2. List the messages: exim -bp
3. Show a summary by sender and recipient: exim -bp | exiqsumm
4. Count only frozen messages: exiqgrep -c -z
5. View the log for one message: exim -Mvl <message-id>

Replace <message-id> with an ID from the list. Find the top senders before you delete anything.

Reducing the queue

Fix the cause first. Removing messages does not stop new mail from being sent.

1. If one account is sending spam, suspend it or disable its outgoing mail.
2. Change the password of any email account that has been used to send spam.
3. Check your scripts and contact forms for loops or unexpected mail.
4. Once the cause is fixed, ask support to retry deferred mail, or retry it yourself if you have root access with exim -qf.

Remove frozen messages only if you have checked them and you have root access. Frozen bounces are often safe to remove. Deferred mail to your own domains may be legitimate.

• Remove frozen messages: exiqgrep -z -i | xargs -r exim -Mrm
• Remove messages older than five days: exiqgrep -o 432000 -i | xargs -r exim -Mrm

Do not delete the whole queue as a first step. This removes all waiting mail, including real messages, and senders are not told.

Troubleshooting

The alert repeats but the queue is small. The threshold may be set lower than normal for your server. Send the alert text and time to support so the team can check the monitoring for your service.

The queue keeps growing. Mail is probably being sent faster than it can be delivered, or an account is sending spam. Check the top senders and contact support if you cannot identify them.

I cannot identify the sender. Do not delete mail you cannot identify. Send the output of the queue summary to support instead.

My legitimate emails are not arriving. Check the recipient's spam folder and the outgoing queue. Contact support if mail to your own domain is stuck.

I cannot find my login details. Check your welcome email. If you still cannot find them, log in to https://my.hostking.host or contact support.

If you are still stuck, contact Hostking support by live chat on the website (7 days a week, 05:00 to 20:00 UTC) or open a support ticket from the client area at https://my.hostking.host.