Header RSS Feed
If you only want to see the articles of a certain category, please click on the desired category below:
ALL Android Backup BSD Database Hacks Hardware Internet Linux Mail MySQL Monitoring Network Personal PHP Proxy Shell Solaris Unix Virtualization VMware Windows Wyse

High CPU load due to mass imap-logins on dovecot
Friday - Mar 15th 2013 - by - (0 comments)

After I received a lot of alerts (high CPU load) on a typical mail server, I took a look at the history in Nagiosgraph:

High CPU load on dovecot imap server 

The alerts began on March 8th but at first I didn't find a reason, why the CPU load would from time to time skyrocket. At first I thought the installed webmail application could be responsible when higher than usual attachments were uploaded, probably causing the server to delay all other processes. But that was not it. However, that thought pushed me to take a look at the disk space movements during the last day. To my big surprise the usage on the log partition went sharp up:

Disk Usage log partition dovecot

So I compared the logs before and after log rotation and found that the dovecot info log grew huge compared with a couple of days ago. The reason were millions of entries like this:

 imap-login: Info: Maximum number of connections from user+IP exceeded (mail_max_userip_connections): user=, method=PLAIN, rip=XXX.xxx.XXX.xxx, lip=xxx.XXX.xxx.XXXX

As I discovered these entries, I got aware that during a second, around 50 new entries like this were written in the logs. Always from the same user and the same remote ip address (rip).

There were a total of 9'316'085 such entries in the logs. In a period from March 8th until the user was blocked. I compared the load peaks with the occurrences of mail_max_userip_connections and they matched - the reason for the high cpu loads was found.

But one mystery remains: What was causing it? I would have liked to know if the user had a virus or was using a completely broken mail client...


Add a comment

Show form to leave a comment

Comments (newest first):

No comments yet.

Go to Homepage home
Linux Howtos how to's
Monitoring Plugins monitoring plugins
Links links

Valid HTML 4.01 Transitional
Valid CSS!
[Valid RSS]

6938 Days
until Death of Computers