[Dovecot] Lots of pop3-logins

[Jose Celestino]

On Qui, 2009-06-25 at 11:15 -0700, V S Rao wrote:
> > > Doing a "ps aux" on my Slackware box, I have approx 100  PID's of "pop3-login's going on.  This is a production mail server, but it is getting VERY low traffic.  In fact, only 3 people can "pop3" into it.  I've check their e-mail clients, and they are not checking mail any more often than every 5 minutes.
> > > 
> > > This is a new installation and I've had the server up and running since Sunday.  If it matters, I'm using Postfix for the MTA and using the Dovecot SASL library to AUTH SMTP.
> > > 
> > > Is this a cause for concern?  Why does Dovecot need this many processes?
> > > 
> > 
> > >> Because dovecot preforks the *-login processes to speed-up the login.
> > 
> > >> No need to worry.
> > 
> > 100 login sessions for just 3 connections? That is not right, no matter what.
> 
> >> No, login_processes_count matters.
> 
> How? If my understanding is correct, you have extra 3 login processes created to cater to new connections. So with only 3 POP3 users, why should so many login processes be spawned? I can understand 10-15. But 100 definitely indicates either the processes are not dying or something else happening on the system which is causing such high number of login processes. The system definitely needs to be checked for some kind of attack, a rogue process running on the system or something else. 
> 

If you don't change the defaults that's right. But the *-login processes
will never be less than login_processes_count so it does matter. And, as
timo pointed out, you can put a upper limit with
login_max_processes_count.

My idle box has 64 imap-login processes and no, I'm not under a
dictionary attack :)

-- Jose Celestino SAPO.pt::Systems http://www.sapo.pt
--------------------------------------------------------------------- *
Progress (n.): The process through which Usenet has evolved from smart
people in front of dumb terminals to dumb people in front of smart
terminals.