[Dovecot] IMP reading entire mailbox

[Chris O'Regan]

We have been noticing a constant hum of traffic between our IMAP server
(Dovecot v1.1.14) and our filers over the past several days. I have
narrowed it down to one particular user who has been logged in to
IMP/Horde since the problem began (he hadn't logged since we upgraded to
Dovecot a week before).

IMP is periodically checking this user's mail every five minutes. Each
time it does, the his entire mailbox is being read. I initially thought
it might be an indexing problem since I am also seeing messages such as
this in the logs:

Corrupted index cache file /local/data/dovecot/indexes/mail/X/XXXXXXXX/.imap/delivery.log/dovecot.index.cache: Broken MIME parts for mail UID 30880

But the in/out bytes being logged by Dovecot indicate that the entire
contents of his mailbox are being sent to the client. That is, this user
has a particularly large mailbox (~500M) and about 500M are being sent
to IMP every five minutes. (Actually, what is the meaning of the above
message? He's the only user logging it.)

The user does have some filters defined in IMP, but I can't imagine that
it would try to apply them to the entire mailbox each time it is
accessed. Surely it would only apply the filters to new messages, right?
But I can't think of any other reason why we would be seeing this
behaviour, and only for this user.

I have not yet contacted the user as I need something to tell him other
than "you're a bandwidth hog". I think the next step is to ask him to
disable his filters, but I would prefer not shooting in the dark.

This user alone is adding about 50Mbps of bandwidth; between the time we
upgraded to Dovecot (from uw-imap) and he logged in, we were witnessing
a huge drop in traffic. He's ruining our graphs! ;-)

Seriously, if anyone has some ideas, please let me know.


Thanks!

-- 
Chris O'Regan <chris at encs.concordia.ca>
Senior Unix Systems Administrator, Academic IT Services
Faculty of Engineering and Computer Science
Concordia University, Montreal, Canada