Hello everyone, I have set up a new MailCow instance and now have the problem that it crashes every 1 to 2 hours and is no longer accessible. After restarting the server everything works again. There is nothing in the MailCow logs to indicate what could be causing this. Has anyone had the same experience or does anyone know of another solution that I can try?

What about your amount of RAM? should be at least 6G, 8G is recommended. Please share your system's details

@"DocFraggle"#p20625 I´ve got 8GB of RAM and a 4 core CPU, as attached. [upl-image-preview uuid=61c5cc64-b995-4d84-b14a-00b710c0d4af url=https://community.mailcow.email/assets/files/2024-12-10/1733835696-839343-screenshot-2024-12-10-140121.png alt={TEXT?}]

Any firewall running? selinux active? Reverse proxy?

@"DocFraggle"#p20628 [upl-image-preview uuid=10cb2ce6-bc24-47b6-baf3-1ea8ac8302d3 url=https://community.mailcow.email/assets/files/2024-12-10/1733836001-432578-screenshot-2024-12-10-140623.png alt={TEXT?}] Yes, there is a firewall as attached. selinux is not active and there no reverse proxys.

@"pascalbcn94"#p20626 ...or did you maybe over-commit RAM too much, in case it's running on a hypervisor? That's of course just a wild guess, but I can tell you from personal experience that exactly the things you describe tend to happen when the VM host is running out of memory. ;-)

@"mlcwuser"#p20630 i am using an hetzner server for the mailcow. I have a other one which is running perfectly fine. This one keeps crashing every few hours. The stats on the hetzner portal are fine, so there should be enough RAM.

I meant a local firewall service running on the VM, not the Hetzner firewall

MailCow crashes

esackbauer

What is crashing? Be more specific. A container? The whole server? What does syslog say?
Are you on an supported operating system and docker version?
I would suggest you open a ticket with Hetzner if nothing is found.

pascalbcn94

DocFraggle ah okay, sorry. No thats the only one i have.

[unknown] the whole server is crashing. Not even the IP is reachable.

I am running the mailcow on debian 11, with the latest docker version.

[unknown] the whole server is crashing. Not even the IP is reachable.

I am running the mailcow on debian 11, with the latest docker version.

[unknown] the whole server is crashing. Not even the IP is reachable.

I am running the mailcow on debian 11, with the latest docker version.

esackbauer

pascalbcn94 Debian 11 is not the latest release. However it should work.
I would open a ticket with Hetzner. I had once a server which would crash every now and then and it turned out to be a defect memory module.

ormad

DocFraggle Can’t ping the VPS anymore, that’s the “crash” mailcow is causing. Same pascalbcn94 reported here. VPS is up but ONLY on local network apparently (web console)

ormad

Hey there, having exact same issue on hetzner vps with 8GB of ram, disabled clamav. IP becomes unreachable and so ssh access too, but hetzner web console works and it shows no errors or abnormal usage of ram. Clam used a LOT of cpu (up to 270x usage) so immediately disabled it but mailcow kept crashing the whole server every time and it happens randomly after 1-2 hours of uptime. There is UFW enabled and it’s an ubuntu 24.04 running there

DocFraggle

ormad There is UFW enabled

Why do you have UFW enabled if you can use the Hetzner firewall? Also, the docs state that you shouldn’t use UFW as it’s prone to errors regarding mailcow:

https://docs.mailcow.email/getstarted/prerequisite-system/#firewall-ports

esackbauer

If its not a hardware error, there should be something in the logs of the operating system or docker itself. Is it ARM or x86?

ormad

DocFraggle I have already tried with it disabled and nothing changes so I guess it’s not that. What happens is of course weird cause isolating network of a machine from external access is something really strange. I also asked to a friend working on containers and he says it’s super weird so maybe there is indeed something wrong in the machine at this point.

esackbauer Yeah definitely, it just had oom errors with process killing with clamav but with it disabled nothing more showed up so I am clueless about this. I had to stop all containers of mailcow and revert back to standard dovecot for now
It’s x86 btw

DocFraggle

ormad What happens is of course weird cause isolating network of a machine from external access is something really strange.

I really don’t get what you mean by that 😃

DocFraggle

Did you have a look at the iptables rules? Maybe you get blocked by fail2ban because a mail client on your host uses a wrong password? Did you check that the VPS isn’t reachable from other hosts as well? In this example 1.2.3.4 is blocked by fail2ban

iptables -L | grep DROP

Chain FORWARD (policy DROP)
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  1.2.3.4              anywhere            
DROP       tcp  --  anywhere             anywhere             /* mailcow isolation */

maban

pascalbcn94

Hello !

I could not see the entry of “ ICMP ” in your firewall !
With it, pinging to your sever should work !

TCP Port 53 , this could be needed for ACME to get the Let’s Encrypt certificates ?!

And :
At Hetzner, it is very easy to check :

make a snapshot
deactivate the Hetzner firewall
install a clean Debian
after that make a ping to the new installed ( and clear ) server
ping is working ? Yes, then your last config was not error free …

All DNS settings are correct ?

Test it with :
https://www.hardenize.com/

https://internet.nl/

Bye, maban

esackbauer

maban TCP Port 53 , this could be needed for ACME to get the Let’s Encrypt certificates ?!

No thats for unbound container being able to resolve DNS. This is not inbound, but outbound (and requires UDP as well)!
Port 80 inbound needs to be open for Lets Encrypt.
https://docs.mailcow.email/getstarted/prerequisite-system/#firewall-ports