Imap client with ~7500 imap cmds ~250/~500 read() syscall

[Marc Roos]

>>  
>> >
>> >> 
>> >>  
>> >> I am playing a bit with the monitoring, and I have noticed there 
is
>> one
>> >> client of the chart with ~7500, while the others are between ~17 
>> >> and
>> ~60
>> >> (dovecot_user_num_cmds).
>> >> 
>> >> I assume this is related to the client, or is it possible 
something
>> is
>> >> wrong on the server side? Is someone having also such numbers or 
is
>> this
>> >> really strange. Is it possible to limit these cmd's?
>> >
>> >Maybe you should look into what command(s) are being executed first?
>> >
>> >event_exporter cmd_export {
>> >  format = json
>> >  format_args = time-rfc3339
>> >  transport = log
>> >}
>> >
>> >metric imap_command {
>> >   event_name = imap_command_finished
>> >   filter {
>> >      user = anomalous
>> >   }
>> >   exporter = cmd_export
>> >}
>> >
>> 
>> Is there also a way to do this on dovecot 2.2?
>
>With rawlogs, I suppose.
>

If I get this raw log, I am getting huge amount of lists

cut -d ' ' -f2 20201230-181651-16624.out |sort | uniq -c | sort -n

        ..
     17 FLAGS
     20 0
    328 NO
   1284 )
   1284
   9021 OK
 133350 LIST