dovecot

[Prev] Thread [Next]  |  [Prev] Date [Next]

Re: [Dovecot] Lots of pop3-logins Jose Celestino Thu Jun 25 14:01:01 2009

On Qui, 2009-06-25 at 11:15 -0700, V S Rao wrote:
> > > Doing a "ps aux" on my Slackware box, I have approx 100  PID's of 
> > > "pop3-login's going on.  This is a production mail server, but it is 
> > > getting VERY low traffic.  In fact, only 3 people can "pop3" into it.  
> > > I've check their e-mail clients, and they are not checking mail any more 
> > > often than every 5 minutes.
> > > 
> > > This is a new installation and I've had the server up and running since 
> > > Sunday.  If it matters, I'm using Postfix for the MTA and using the 
> > > Dovecot SASL library to AUTH SMTP.
> > > 
> > > Is this a cause for concern?  Why does Dovecot need this many processes?
> > > 
> > 
> > >> Because dovecot preforks the *-login processes to speed-up the login.
> > 
> > >> No need to worry.
> > 
> > 100 login sessions for just 3 connections? That is not right, no matter 
> > what.
> 
> >> No, login_processes_count matters.
> 
> How? If my understanding is correct, you have extra 3 login processes created 
> to cater to new connections. So with only 3 POP3 users, why should so many 
> login processes be spawned? I can understand 10-15. But 100 definitely 
> indicates either the processes are not dying or something else happening on 
> the system which is causing such high number of login processes. The system 
> definitely needs to be checked for some kind of attack, a rogue process 
> running on the system or something else. 
> 

If you don't change the defaults that's right. But the *-login processes
will never be less than login_processes_count so it does matter. And, as
timo pointed out, you can put a upper limit with
login_max_processes_count.

My idle box has 64 imap-login processes and no, I'm not under a
dictionary attack :)

-- Jose Celestino SAPO.pt::Systems http://www.sapo.pt
--------------------------------------------------------------------- *
Progress (n.): The process through which Usenet has evolved from smart
people in front of dumb terminals to dumb people in front of smart
terminals.