[Dovecot] Broken IMAPS Connects Create Lingering imap-login Processes

[Jochen Bern]

On 06.05.2014 14:14, Timo Sirainen wrote:
> On 5.5.2014, at 23.13, Jochen Bern <Jochen.Bern at LINworks.de> wrote:
>> The problem I'ld like to ask for help with here is that dovecot's
>> imap-login process doesn't terminate when the FIN is received, or when
>> the IMAP protocol's inactivity timeout is reached, it takes *more than
>> two hours* for it to go away. Because of that, this single client racks
>> up 1100+ processes (counting against dovecot's configured limits), TCP
>> connections, and the associated RAM usage.
> ..
>> dovenull 12064  0.0  0.0  42440  3656 ?        S    19:32   0:00  \_ dovecot/imap-login [1 connections (1 TLS)]
> 
> The process is taking 0% CPU?

Less than 0.002%, in any case.

> There was bug where a broken handshake could have caused 100% CPU
> usage. Maybe the same problem could happen in a slightly different
> way and also not cause CPU usage.
> http://hg.dovecot.org/dovecot-2.2/rev/c0236d1c4a04 fixes this.
> 
> Although even then .. I'm not sure why the process wouldn't die
> sooner. And Dovecot especially should kill old imap-login processes
> that haven't logged in if it reaches the imap-login process limit.
> 
> I'd anyway try v2.2 first..

Thanks for the pointers. We're having a change management and an
official-repos-if-at-all-possible policy going on, so I'll likely start
with adding just this patch and (belt and suspenders ;-) a bit of
"iptables -m connlimit" in the upcoming maintenance windows.

Watching the production server run up to the limits hoping that they'll
prove to be padded walls *this* time (rather than raising malfunction
alerts in hundreds of client sites as usual) takes a braver man than
myself, I'm afraid ... :-}

Kind regards,
								J. Bern
-- 
*NEU* - NEC IT-Infrastruktur-Produkte im <http://www.linworks-shop.de/>:
Server--Storage--Virtualisierung--Management SW--Passion for Performance
Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/>
Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt
PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27
Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202
Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel