1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
|
<html>
<head>
<title> Postfix Configuration - Resource Controls</title>
</head>
<body>
<h1><a href="big-picture.html"><img src="small-picture.gif" width="115" height="45"></a> Postfix Configuration - Resource Controls</h1>
<hr>
<a href="index.html">Up one level</a> | <a href="basic.html">Basic
Configuration</a> | <a href="uce.html">UCE Controls</a> | <a
href="rate.html">Rate Controls</a> | Resource Controls | <a
href="rewrite.html">Address Manipulation</a>
<h2> Introduction</h2>
The Postfix system is designed to run within a finite memory budget.
To this end, there are configurable limits on the <i>size</i> of
in-memory objects such as text line fragments, on the <i>number of
instances</i> of such objects, and on the <i>time</i> an operation
may take. In addition, strategies are in place for dealing with
resource exhaustion. The idea is to keep running under conditions
of stress, without making the problem worse.
<p>
<ul>
<li> <a href="#size">Object size limits</a>
<p>
<li> <a href="#count">Object count limits</a>
<p>
<li> <a href="#time">Time limits</a>
<p>
<li> <a href="#lock">Acquiring exclusive file locks</a>
<p>
<li> <a href="#fan">Error recovery</a>
</ul>
<a name="size"><h2> Object size limits</h2> </a>
The first step towards a fixed memory resource budget is to limit
the size of each in-memory object. Once the size of in-memory
objects is limited, total memory consumption is limited by limiting
the number of object instances. Simple, no?
<p>
<dl>
<dt> <b>line_length_limit</b> (default: 2048 bytes)
<dd> How long a line of text can be before it is broken up into
pieces. All Postfix perimeter programs (<a href="smtpd.8.html">SMTP
server</a>, <a href="smtp.8.html">SMTP client</a>, <a
href="pickup.8.html">local pickup</a> and <a href="local.8.html">local
delivery</a>) enforce this line length limit when reading data from
an untrusted source. Long lines are reconstructed upon delivery.
<p>
<dt> <b>header_size_limit</b> (default: 102400 bytes)
<dd> How much text may be carried in a multi-line message header.
Header text that does not fit in <b>$header_size_limit</b> bytes
overflows into the message body. This limit is enforced by the <a
href="cleanup.8.html"> cleanup</a> header rewriting code.
</dl>
<p>
The following parameters restrict the use of file system storage:
<dl>
<dt> <b>message_size_limit</b> (default: 10240000 bytes)
<dd> The maximal size of a Postfix queue file for inbound mail,
including envelope information (sender, recipient, etc.).
<p>
<dt> <b>queue_minfree</b> (default: no restriction)
<dd> How many bytes of free space are needed in the queue file
system. The <a href="smtpd.8.html">SMTP server</a> declines inbound
mail delivery requests when there is insufficient space (the mail
will be accepted once enough space becomes available). There is
no default limit; however, it seems like a good idea to require at
least several times <b>$message_size_limit</b> so that the mail
system won't get stuck on a single large message.
<p>
<dt> <b>bounce_size_limit</b> (default: 50000 bytes)
<dd> How much of an undelivered message is sent back to the sender.
</dl>
<a name="count"><h2> Object count limits</h2> </a>
Once the sizes of memory objects have been limited, the next step
to implement Postfix's finite memory budget is to limit the number
of in-memory object instances.
<dl>
<dt> <b>qmgr_message_recipient_limit</b> (default: 10000)
<dd> An upper bound on the number of <a href="qmgr.8.html">queue
manager</a> in-memory recipient address data structures. This
parameter also controls the number of instances of other in-memory
data structures. See, for example, the <a
href="rate.html#backoff">delivery rate control</a> documentation.
<p>
<dt> <b>qmgr_message_active_limit</b> (default: 1000)
<dd> An upper limit on the number of messages in the <b>active</b>
queue. For an introduction to the Postfix queue organization see
the <a href="queuing.html">Postfix overview</a> documentation.
<p>
<dt> <b>duplicate_filter_limit</b> (default: 1000)
<dd> How many recipient addresses the <a href="local.8.html">local
delivery</a> agent and <a href="cleanup.8.html">address cleanup</a>
daemon remember when delivering a message. A recipient address is
ignored when it is found in the remembered list.
</dl>
<a name="time"><h2> Time limits</h2> </a>
External commands are given a finite time for completion. Such
commands are run by the <a href="local.8.html">local</a> delivery
agent when it finds a "|<i>command</i>" destination in an <a
href="aliases.5.html">alias</a> database, <a
href="aliases.5.html">:include:</a> file or <a
href="aliases.5.html">.forward</a> file. The <a
href="pipe.8.html">pipe</a> mailer implements an alternative way
to pipe mail into external commands.
<dl>
<dt> <b>command_time_limit</b> (default: 1000 seconds)
<dd> How long the <a href="local.8.html">local</a> delivery agent
will wait before aborting an external command.
<p>
<dt> <i>service_name</i><b>_time_limit</b> (default:
<b>$command_time_limit</b>)
<dd> The time limit for delivery to external commands via the
<b>pipe</b> mailer. For <i>service_name</i>, substitute the service
name (the first field in the <b>master.cf </b> file).
</dl>
<a name="lock"><h2> Acquiring exclusive file locks</h2> </a>
Internally, the Postfix programs cooperate in a very disciplined
manner and rarely need to fight for exclusive file access. However,
access conflicts may happen on the outside, for example, when mail
has to be delivered while a user is accessing her mailbox. Postfix
supports two types of file locks:
<ul>
<li>Internal locks, implemented with the <b>fcntl()</b> or
<b>flock()</b> system primitives.
<p>
<li>External locks, implemented as files named <i>file</i><b>.lock</b>.
</ul>
Depending on the host system, Postfix uses one method or both.
The following configuration parameters control how Postfix deals
with file locks:
<dl>
<dt> <b>deliver_lock_attempts</b> (default: 5)
<dd> The number of times to try locking a file before giving up.
<p>
<dt> <b>deliver_lock_delay</b> (default: 1 second)
<dd> How long to wait between attempts to lock a file.
<p>
<dt> <b>stale_lock_time</b> (default: 500)
<dd> How old an external lock file may be before it is forcibly
removed.
</dl>
<a name="fan"><h2> Error recovery</h2> </a>
Under conditions of severe stress, available system resources may
be insufficient to accommodate Postfix's needs. The world may also
seem to fall apart when a Postfix configuration file is broken, or
when a Postfix program is defective.
<p>
The general approach taken in the face of disaster is to terminate
with a fatal run-time error (or with a panic in case of software
problems), and to try again after some time (the <a
href="master.8.html">master</a> daemon will restart processes after
some delay). Each failed attempt is logged; hopefully, someone will
notice the problem and fix it.
<p>
Some recovery strategies were implemented very early during Postfix
development, and haven't been made configurable yet. What follows
is the beginning of a growing list of recovery control parameters:
<dl>
<dt> <b>fork_attempts</b> (default: 5 times)
<dd> The number of times to attempt to create a new process before
giving up.
<p>
<dt> <b>fork_delay</b> (default: 1 second)
<dd> The delay between attempts to create a new process.
<p>
<dt> <b>transport_retry_time</b> (default: 60 seconds)
<dd> The amount of time between queue manager attempts to contact
an apparently defunct Postfix delivery service.
</dl>
<hr>
<a href="index.html">Up one level</a> | <a href="basic.html">Basic
Configuration</a> | <a href="uce.html">UCE Controls</a> | <a
href="rate.html">Rate Controls</a> | Resource Controls | <a
href="rewrite.html">Address Manipulation</a>
</body>
</html>
|
