Event 0x2b1a5f270bd0 leaked (parent=(nil)): auth-client-connection.c:338

[Mart Pirita]

Hi,

Auth process is not constantly being shutdown and/or restarted and Dovecot is used for SMTP authentication (Postfix).

Checked few servers logs, they are running v2.3.3, for example latest
(some day none, some day a lot, some day few) logs:

Nov 25 18:48:11 server1 dovecot: auth: Warning: Event 0x2b79250f15f0
leaked (parent=(nil)): auth-client-connection.c:338
Nov 25 18:48:11 server1 dovecot: auth: Warning: Event 0x2b79250ddc50
leaked (parent=(nil)): auth-client-connection.c:338
Nov 25 22:55:38 server1 dovecot: auth: Warning: Event 0x2b374a7bafb0
leaked (parent=(nil)): auth-client-connection.c:338
Nov 26 03:08:24 server1 dovecot: auth: Warning: Event 0x2b9b89e79040
leaked (parent=(nil)): auth-client-connection.c:338

Nov 25 04:38:04 server2 dovecot: auth: Warning: Event 0x2b4afb1ac370
leaked (parent=(nil)): auth-client-connection.c:338
Nov 25 04:38:04 server2 dovecot: auth: Warning: Event 0x2b4afb18eeb0
leaked (parent=(nil)): auth-client-connection.c:338
Nov 25 04:38:04 server2 dovecot: auth: Warning: Event 0x2b4afb183490
leaked (parent=(nil)): auth-client-connection.c:338
Nov 25 04:38:04 server2 dovecot: auth: Warning: Event 0x2b4afb18a900
leaked (parent=(nil)): auth-client-connection.c:338
Nov 25 04:38:04 server2 dovecot: auth: Warning: Event 0x2b4afb193d20
leaked (parent=(nil)): auth-client-connection.c:338


Conf:

# 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf
# OS: Linux 2.6.18-419.el5 x86_64 CentOS release 5.11 (Final)
auth_cache_size = 1 k
auth_failure_delay = 1 mins
auth_mechanisms = plain login
base_dir = /var/run/dovecot/
disable_plaintext_auth = no
listen = *
login_log_format_elements = %u %r %m %c
mail_location = maildir:~/Maildir
mail_log_prefix = "%s(%u): "
mail_plugins = " mail_log notify"
mbox_very_dirty_syncs = yes
passdb {
  args = cache_key=#hidden_use-P_to_show# *
  driver = pam
}
plugin {
  autocreate = Drafts
  autocreate2 = Sent Items
  autosubscribe = Drafts
  autosubscribe2 = Sent Items
  fts_autoindex = yes
  mail_log_events = delete undelete expunge copy mailbox_delete
mailbox_rename
  mail_log_fields = uid box msgid size from subject vsize flags
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
}
service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 110
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}
ssl_ca = </etc/ssl/certs/mail.ca.crt
ssl_cert = </etc/ssl/certs/mail.fullchain.cer
ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
ssl_prefer_server_ciphers = yes
state_dir = /var/run/dovecot
userdb {
  driver = passwd
}
protocol imap {
  imap_client_workarounds = tb-extra-mailbox-sep delay-newmail
  imap_logout_format = %{rip}, bytes=%i/%o, del=%{deleted}
  mail_max_userip_connections = 90
}
protocol pop3 {
  mail_max_userip_connections = 9
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_logout_format = bytes=%i/%o, del=%d/%m, size=%s
}


Timo Sirainen wrote:
> On 3 Nov 2018, at 17.41, Mart Pirita <sysadmin at e-positive.ee> wrote:
>> Hi,
>>
>>
>> But this harmless is spamming logs, so how to disable it:
>>
>> grep auth-client-connection.c:338 maillog | wc -l
>>    1259
> Actually this specific event leak isn't a known issue. I don't really understand how it could happen. These event leaks are supposed to be checked only at process deinit. Is the auth process constantly being shutdown and restarted? What's your doveconf -n? Are you using Dovecot for SMTP authentication or some other external auth?
>
>
>> Aki Tuomi wrote:
>>>> On 03 November 2018 at 12:12 Mart Pirita < sysadmin at e-positive.ee <mailto:sysadmin at e-positive.ee> 
>>>> <mailto:sysadmin at e-positive.ee <mailto:sysadmin at e-positive.ee>>> wrote:
>>>>
>>>>
>>>> Hi,
>>>>
>>>>
>>>> Noticed with latest v2.3.3 some new warning in logs, for example:
>>>>
>>>> dovecot: auth: Warning: Event 0x80a6fc0 leaked (parent=(nil)):
>>>> auth-client-connection.c:338: 1 Time(s)
>>>> dovecot: auth: Warning: Event 0x80aa1c8 leaked (parent=(nil)):
>>>> auth-client-connection.c:338: 1 Time(s)
>>>> dovecot: auth: Warning: Event 0x80aa718 leaked (parent=(nil)):
>>>> auth-client-connection.c:338: 1 Time(s)
>>>> dovecot: auth: Warning: Event 0x80adac0 leaked (parent=(nil)):
>>>> auth-client-connection.c:338: 1 Time(s)
>>>> dovecot: auth: Warning: Event 0x80b6c38 leaked (parent=(nil)):
>>>> auth-client-connection.c:338: 1 Time(s)
>>>> dovecot: auth: Warning: Event 0x80c0e00 leaked (parent=(nil)):
>>>> auth-client-connection.c:338: 1 Time(s)
>>>> dovecot: auth: Warning: auth client 0 disconnected with 1 pending
>>>> requests: EOF: 12 Time(s)
>>>>
>>>>
>>>> What are they?
>>>>
>>>>
>>>> -- 
>>>> Mart
>>> Hi! It's harmless event leak. This is a known issue to us.
>>> ---
>>> Aki Tuomi
>> -- 
>> Mart


-- 
Mart