Hi,

I have not touched any config. of the server recently. After working for some days, I found the mailbox was stopped suddenly today. Users could not check email. The direct method was to restart the service. After I checked the log, I just found the SASL login auth. failed suddenly. Afterwards, the mailbox service was stopped. It's not a good day. I am afraid of the same event happen later without control. What I have to check next?


Code:
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: antispam: Running
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: antivirus: Running
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: ldap: Running
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: logger: Stopped
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: mailbox: Running
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: mta: Running
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: snmp: Running
Mar 23 09:37:04 mailsrv zimbramon[3159]: 3159:info: 2006-03-23 09:37:01, STATUS: safp.gov.mo: spell: Running
Mar 23 09:37:30 mailsrv postfix/smtpd[3144]: connect from unknown[192.168.216.251]
....
....SOME NORMAL SMTP TRAFFIC
....
Mar 23 09:37:37 mailsrv amavis[28776]: (28776-08) extra modules loaded: Net/LDAP/Bind.pm
Mar 23 09:37:55 mailsrv postfix/smtpd[3144]: connect from unknown[192.168.216.251]
Mar 23 09:37:55 mailsrv postfix/smtpd[3144]: warning: unknown[192.168.216.251]: SASL LOGIN authentication failed
Mar 23 09:37:55 mailsrv postfix/smtpd[3144]: lost connection after AUTH from unknown[192.168.216.251]
Mar 23 09:37:55 mailsrv postfix/smtpd[3144]: disconnect from unknown[192.168.216.251]
Mar 23 09:37:59 mailsrv postfix/smtpd[3144]: connect from unknown[192.168.216.251]
Mar 23 09:37:59 mailsrv postfix/smtpd[3144]: warning: unknown[192.168.216.251]: SASL LOGIN authentication failed
Mar 23 09:37:59 mailsrv postfix/smtpd[3144]: lost connection after AUTH from unknown[192.168.216.251]
Mar 23 09:37:59 mailsrv postfix/smtpd[3144]: disconnect from unknown[192.168.216.251]
Mar 23 09:38:02 mailsrv postfix/smtpd[3144]: connect from unknown[192.168.216.251]
Mar 23 09:38:02 mailsrv postfix/smtpd[3144]: warning: unknown[192.168.216.251]: SASL LOGIN authentication failed
Mar 23 09:38:02 mailsrv postfix/smtpd[3144]: lost connection after AUTH from unknown[192.168.216.251]
Mar 23 09:38:02 mailsrv postfix/smtpd[3144]: disconnect from unknown[192.168.216.251]
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: antispam: Running
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: antivirus: Running
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: ldap: Running
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: logger: Stopped
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: mailbox: Stopped
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: mta: Running
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: snmp: Running
Mar 23 09:38:04 mailsrv zimbramon[3438]: 3438:info: 2006-03-23 09:38:02, STATUS: safp.gov.mo: spell: Running
Mar 23 09:38:05 mailsrv postfix/smtpd[3144]: warning: unknown[192.168.216.251]: SASL LOGIN authentication failed
Mar 23 09:38:05 mailsrv postfix/smtpd[3144]: lost connection after AUTH from unknown[192.168.216.251]
PS. GA160 under FC4

Thomas