- dovecot - dovecot.org

Re: dovecot config for 1500 simultaneous connection
by Rajesh M 15 Feb '17

15 Feb '17

christian the servers i currently own are dell servers. The servers i plan to buy are Dell R530, 2U rack servers with 8 x 3.5 inch drives, with 64 gb ram each, Hardware raid. I am thinking of 2 X 300 gb ssds raid1 and 6 x 2 tb drives in raid10 for data. I do not have any experience in setting up drdb (that would be my next step) ... primarily using standalone servers with hardware level redundancy. For backup-ups i rsync data to backup servers, also use qmail taps for backing up sent/recd emails on a per user basis. i am using mysql authentication backend my mail server is qmailtoaster, ie with vpopmail, spamdyke, simscan. you had mentioned as follows ############## With 4000 users and 5 logins/s I can't imagine anything that wouldn't be able to: a) put all of the relevant data into RAM and b) thus handle auth requests in very timely manner. The example I gave earlier about my servers with 140 logins/s authenticates against LDAP and isn't very busy doing so while also fitting all 2.7GB of data for about 1 million users into RAM. ############## >>>>>>>>>>>>>>>>>>how do i put all relevant data into the RAM ? thanks rajesh ----- Original Message ----- From: Christian Balzer [mailto:chibi@gol.com] To: dovecot(a)dovecot.org Sent: Tue, 14 Feb 2017 16:40:01 +0900 Subject: Hello, On Mon, 13 Feb 2017 22:53:23 +0530 Rajesh M wrote: > thanks for your help > > happy to say that the performance dramatically improved after i use the high performance settings from here > http://wiki.dovecot.org/LoginProcess > That's why that page is there. > grep Login: /var/log/mail.log.1 |wc -l > with the mail.log being of a typical, busy day. > 412992 > So about 5 login/s, not that busy, but that of course also depends on your HW and authentication backend. > i also picked up the imap and pop3 connections during peak hours > [root@ns1 domains]# doveadm who | awk '/imap/{m+=$2}/pop3/{n+=$2}END{print m,n}' > username # proto (pids) (ips) > > max figures i got was 535 for imap and 97 for pop > > > Question 1 > i wish to improve the performance further by caching the logins. current the same is kept disable because when user's change passwords then they are not able to immediately login with the new password for some time. How to solve this issue. > There is no solution, caching auth data is by default fraught with that sort of peril. And how did you determine that caching auth data would actually improve things? What is your authentication backend? With 4000 users and 5 logins/s I can't imagine anything that wouldn't be able to: a) put all of the relevant data into RAM and b) thus handle auth requests in very timely manner. The example I gave earlier about my servers with 140 logins/s authenticates against LDAP and isn't very busy doing so while also fitting all 2.7GB of data for about 1 million users into RAM. > > > further to the above. > i am planning to put up a large mail server with one of the following options > Don't plan 1, always plan a pair and then use whatever you're comfortable with to turn them into a HA cluster, like Pacemaker with DRBD. > option 1 > OS and mailqueue : 2 X 600 gb 15k rpm raid 1 What kind of RAID, HW or MD? > data : 4 X 2000 gb raid 10 for data > backup : 2 X 2000 gb raid 10 for backup While with Linux MD a 2 disk RAID10 would be possible, it wouldn't be particular helpful (slower than a RAID 1 with writes). > 32 gb ram > > > option 2 > os and mail queue : 4 X 600 gb 15k rpm raid 10 Those 15k HDDs tend to be expensive. Estimate your expected writes per day (iostat on an existing server can give you some hints) and get 2 SSDs instead, DC S3520s if 1 DWPD is sufficient, DC S3610s if you need 3 DWPD (doubtful), S3710 if you need 10 DWPD (very doubtful). Similar for Samsung DC level SSDs, check their specs. For example, my busiest mailbox servers only write about 250KB/s averaged, which mean about 50GB/day and thus would be a fit even for a small S3520. I'm still using 200GB S3710s because I can afford them, like the speed and never ever want to worry about wearout. > data : 4 X 2000 gb raid 10 for data > 32 gb ram > > i am having the OS and mail queue on primary drives > > i understand that Raid10 give a faster write and read whereas Raid 1 will have slow writes and fast reads > While that is true, you're missing the real difference here, the number of HDDs. With 4 of them in the RAID10 they will be twice as fast as the 2 disk RAID1. This can be tweaked even further with the various RAID 10 layout options, "man md". > the question is will there be huge performance difference between Raid1 and Raid 10 when it comes small files like mail queue ? > Again as explained above, double the IOPS, so yes. Christian > > thanks > rajesh > ----- Original Message ----- > From: Christian Balzer [mailto:chibi@gol.com] > To: dovecot(a)dovecot.org > Cc: kevin(a)my.walr.us > Sent: Mon, 13 Feb 2017 10:46:13 +0900 > Subject: > > > Hello, > > On Sun, 12 Feb 2017 08:27:21 -0500 KT Walrus wrote: > > > Thanks for the info. I do have one further question for you. On your servers that are currently handling 50k IMAP sessions, how many users does that correspond to? Since many users will have multiple IMAP sessions on multiple devices, I’d like to hear about some real-world numbers that could be used for budgeting a new project like mine. > > > > Those servers would actually be the wrong ones to look at, as they are > primarily accessed by the aforementioned broken client, so the numbers are > somewhat skewed. > However looking at other servers with a more "normal" user spread things > aren't actually too different. > > The average number of sessions per user tends to be 2. > The clear majority (over 50%) only has one session open (people with well > behaved and configured clients watching the INBOX mostly). > Another 30% has 2 sessions open, again the typical state of this would be > clients watching another mailbox besides INBOX, typically SENT. > The rest has 3 and more sessions open. > > The number of sessions could of course be drastically reduced if any > client would support IMAP NOTIFY, alas none that I'm aware of do. > > Lastly no more than 60% of the session seem to be in IDLE at any given > time, so my comments about RAM and IMAP hibernation effectiveness stand. > > > Also, do you use Dovecot IMAP proxies in front of your backend servers? If so, how many IMAP sessions can one proxy server handle (assuming the proxy does authorization using MySQL running on a separate server)? And, could the proxy server be tuned to help in optimizing mostly IDLE backend sessions? > > > > Yes to Dovecot Proxying, of course. > > No idea about MySQL, with (Open)LDAP nothing is breaking a sweat at an > average of 140 logins per second (IMAP and POP) on the 2 proxy servers. > If you can fit your entire dataset into RAM it should be fine, my LDAP > servers fall into that category and take about 10% of a slow (1.2GHz, 34%, > power-save mode) core only to handle the that load (also 2 servers). > And the rate of logins/s is what you need to worry about most and optimize > for. > > The proxies will of course have to do the shuffling of data and SSL > en/de-coding, but again they're not particular busy with that. > > The number of sessions comes into play when looking at the number of login > processes on the proxies and their memory footprint. > An IMAP login process on the proxies in performance mode with a client > limit of 1000 will consume about 55MB at most. > So assume at least 55KB RAM per session. > > Read Timo's mail I linked to about IMAP hibernation, AFAIK nothing has > happened to make proxies more supportive for this though. > > Christian > > > On Feb 12, 2017, at 1:58 AM, Christian Balzer <chibi(a)gol.com> wrote: > > > > > > > > > Hello, > > > > > > On Fri, 10 Feb 2017 14:50:03 -0500 KT Walrus wrote: > > > > > >>> 1. 256GB of real RAM, swap is for chums. > > >> > > >> Are you sure that 100,000 IMAP sessions wouldn’t work well with SWAP, especially with fast SSD storage (which is a lot cheaper than RAM)? > > >> > > > > > > I'm sure about tax and death, not much else. > > > > > > But as a rule of thumb I'd avoid swapping out stuff on production servers, > > > even if it were to SSDs. > > > Incidentally the servers I'm talking about here have their OS and swap on > > > Intel DC S3710s (200GB) and the actual storage on plenty of 1.6TB DC > > > S3610s. > > > > > > Relying on the kernel to make swap decisions is likely to result in much > > > reduced performance even with fast SWAP when you're overcommitting things > > > on that scale. > > > > > > > > > But read on. > > > > > >> Seems that these IMAP processes are long lived processes (idling most of the time) that don’t need that much of the contents of real memory available for much of the life of the process. I use a database proxy in front of MySQL (for my web apps) so that there can be a large number of TCP connections to the proxy where the frontend requests are queued for execution using a small number of backend connections. > > >> > > >> Could Dovecot IMAP be re-written to be more efficient so it works more like MySQL (or other scalable data servers) that could handle a million or more IMAP sessions on a server with 32GBs or less of RAM? Those IMAP sessions aren’t doing much most of the time and shouldn’t really average 2MB of active data per session that needs to be resident in main memory at all times. > > >> > > > See IMAP hibernation: > > > https://www.mail-archive.com/dovecot@dovecot.org/msg63429.html <https://www.mail-archive.com/dovecot@dovecot.org/msg63429.html> > > > > > > I'm going to deploy/test this in production in about 2 months from now, > > > but if you look at the link and the consequent changelog entries you'll see > > > that it has certain shortcomings and bug fixes in pretty much each release > > > after it was introduced. > > > > > > But this is the correct way to tackle things, not SWAP. > > > > > > Alas I'm not expecting miracles and if more than 20% of the IMAP sessions > > > here will be hibernated at any given time I'd be pleasantly surprised. > > > > > > Because between: > > > > > > 1. Finding a sensible imap_hibernate_timeout. > > > > > > 2. Having well behaved clients that keep idling instead of restarting the > > > sequence (https://joshdata.wordpress.com/2014/08/09/how-bad-is-imap-idle/ <https://joshdata.wordpress.com/2014/08/09/how-bad-is-imap-idle/>) > > > > > > 3. Having lots of mobile clients who either get disconnected (invisible to > > > Dovecot) or have aggressive IDLE timers to overcome carrier NAT timeouts > > > (a large mobile carrier here times out idle TCP sessions after 2 minutes, > > > forcing people to use 1 minute IDLE renewals, making 1. up there a > > > nightmare). > > > > > > 4. Having really broken clients (don't ask, I can't tell) which open IMAP > > > sessions, don't put them into IDLE and thus having them expire after 30 > > > minutes. > > > > > > the pool of eligible IDLE sessions isn't as big as it could be, in my case > > > at least. > > > > > >> My mail server isn’t that large yet as I haven’t fully deployed Dovecot outside my own small group yet, but it would be nice if scaling Dovecot IMAP to millions of users wasn’t limited to 50,000 IMAP sessions on a server... > > >> > > > > > > Scaling up is nice and desirable from a cost (rack space, HW) perspective, > > > but the scalability of things OTHER than Dovecot as I pointed out plus > > > that little detail of failure domains (do you really want half of your > > > eggs in one basket?) argue for scaling out after a certain density. > > > > > > I'm feeling my way there at this time, but expect more than 100k sessions > > > per server to be tricky. > > > > > > Lastly, when I asked about 500k sessions per server here not so long ago, > > > ( http://www.dovecot.org/list/dovecot/2016-November/106284.html <http://www.dovecot.org/list/dovecot/2016-November/106284.html> ) > > > Timo mentioned that he's not aware of anybody doing more than 50k per > > > server, something I got licked already and definitely will go to 100k > > > eventually. > > > > > > Regards, > > > > > > Christian > > >>> On Feb 10, 2017, at 11:07 AM, Christian Balzer <chibi(a)gol.com> wrote: > > >>> > > >>> On Fri, 10 Feb 2017 07:59:52 -0500 KT Walrus wrote: > > >>> > > >>>>> 1500 IMAP sessions will eat up about 3GB alone. > > >>>> > > >>>> Are you saying that Dovecot needs 2MB of physical memory per IMAP session? > > >>>> > > >>> That depends on the IMAP session, read the mailbox size and index size, > > >>> etc. > > >>> Some are significantly larger: > > >>> --- > > >>> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > > >>> 1033864 mail 20 0 97600 67m 54m S 0 0.1 0:01.15 imap > > >>> --- > > >>> > > >>> But yes, as somebody who has mailbox servers with 55k+ session the average > > >>> is around 1.6MB. > > >>> > > >>>> If I want to support a max 100,000 IMAP sessions per server, I should configure the server to have at least 200GBs of SWAP? > > >>>> > > >>> You will want: > > >> > > >>> 2. Understanding how to tune Dovecot and more importantly the overall > > >>> system to such a task (see that PID up there?). > > >>> 3. Be willing to deal with stuff like top and ps taking ages to start/run > > >>> and others like atop actually killing dovecot (performance wise, not > > >>> literally) when doing their obviously flawed cleanup on exit. Some things > > >>> clearly do NOT scale well. > > >>> > > >>> My current goal is to have 100k capable servers that work well, 200k in a > > >>> failover scenario, but that won't be particular enjoyable. > > >>> > > >>> Christian > > >>> > > >>>>> On Feb 10, 2017, at 3:58 AM, Christian Balzer <chibi(a)gol.com> wrote: > > >>>>> > > >>>>> On Fri, 10 Feb 2017 01:13:20 +0530 Rajesh M wrote: > > >>>>> > > >>>>>> hello > > >>>>>> > > >>>>>> could somebody with experience let me know the dovecot config file settings to handle around 1500 simultaneous connections over pop3 and 1500 connection over imap simultaneously. > > >>>>>> > > >>>>> > > >>>>> Be very precise here, you expect to see 1500 as the result of > > >>>>> "doveadm who |grep pop3 |wc -l"? > > >>>>> > > >>>>> Because that implies an ungodly number of POP3 connects per second, given > > >>>>> the typically short duration of these. > > >>>>> > > >>>>> 1500 IMAP connections (note that frequently a client will have more than > > >>>>> the INBOX open and thus have more than one session and thus process on the > > >>>>> server) are a much easier proposition, provided they are of the typical > > >>>>> long lasting type. > > >>>>> > > >>>>> So can you put a number to your expected logins per second (both protocols)? > > >>>>> > > >>>>>> my server > > >>>>>> > > >>>>>> server configuration > > >>>>>> hex core processor, 16 gb ram 1 X 600 gb 15 k rpm for main drive and 2 X 2000 > > >>>>>> gb hdd for data (No raid) > > >>>>>> > > >>>>> No RAID and no other replication like DRBD? > > >>>>> Why would you even bother? > > >>>>> > > >>>>> How many users/mailboxes in total with what quota? > > >>>>> > > >>>>> 1500 IMAP sessions will eat up about 3GB alone. > > >>>>> You will want more memory, simply to keep all relevant SLAB bits (inodes, > > >>>>> dentries) in RAM. > > >>>>> > > >>>>> If you really have several hundreds logins/s, you're facing several > > >>>>> bottlenecks: > > >>>>> 1. Login processes themselves (easily fixed by high performance mode) > > >>>>> 2. Auth processes (that will depend on your backends, method mostly) > > >>>>> 3. Dovecot master process (spawning mail processes) > > >>>>> > > >>>>> The later is a single-threaded process, so it will benefit from a faster > > >>>>> CPU core. > > >>>>> It can be dramatically improved by enabling process re-usage, see: > > >>>>> http://wiki.dovecot.org/PerformanceTuning > > >>>>> > > >>>>> However that also means more memory usage. > > >>>>> > > >>>>> > > >>>>> > > >>>>> Christian > > >>>>> > > >>>>>> > > >>>>>> thanks > > >>>>>> rajesh > > >>>>>> > > >>>>> > > >>>>> [snip] > > >>>>> -- > > >>>>> Christian Balzer Network/Systems Engineer > > >>>>> chibi(a)gol.com Global OnLine Japan/Rakuten Communications > > >>>>> http://www.gol.com/ > > >>>> > > >>> > > >>> > > >>> -- > > >>> Christian Balzer Network/Systems Engineer > > >>> chibi(a)gol.com <mailto:chibi@gol.com> <mailto:chibi@gol.com <mailto:chibi@gol.com>> Global OnLine Japan/Rakuten Communications > > >>> http://www.gol.com/ <http://www.gol.com/> <http://www.gol.com/ <http://www.gol.com/>> > > > > > > > > > -- > > > Christian Balzer Network/Systems Engineer > > > chibi(a)gol.com <mailto:chibi@gol.com> Global OnLine Japan/Rakuten Communications > > > http://www.gol.com/ <http://www.gol.com/> > > > > -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/

2 1

Re: dovecot config for 1500 simultaneous connection
by Joseph Tam 15 Feb '17

15 Feb '17

Rajesh M wrote: > i wish to improve the performance further by caching the logins. > current the same is kept disable because when user's change passwords > then they are not able to immediately login with the new password for > some time. How to solve this issue. Dovecot shouldn't be doing that. According to https://wiki2.dovecot.org/Authentication/Caching Data is used from the cache if it's not expired (auth_cache_ttl setting) - If authentication fails this time, but it didn't fail last time, it's assumed that the password has changed and a database lookup is done. As I read it, an authentication failure will cause an update of cache credentials. The problem I encountered is the converse -- a user changes their password, but forgets to update their mail reader's or web browser's stored password, which continues to work until the TTL expires. Another related security situation I've encountered is when a fraudster has phished a user's password. A user/admin changes the password, but forgets to invalidate dovecot's cached entry, allowing the fraudster contunuing access to the mail account until the TTL expires or user logs in with new credentials. I've been burnt by this one. Joseph Tam <jtam.home(a)gmail.com>

2 2

pop3 login core dump
by Luciano Mannucci 14 Feb '17

14 Feb '17

Hello! Sorry for my newbie question, I've notied some lines in my logfile like this: Feb 13 16:05:54 pop3-login: Fatal: master: service(pop3-login): child 10660 killed with signal 11 (core not dumped - add -D parameter to service pop3-login { executable } ... where am I supposed to add the -D option in order to get the core file dumped so I can examine it? Thanks to all, luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

1 2

Mailbox suddenly inaccessible
by Sven Strickroth 14 Feb '17

14 Feb '17

Hi, out of the sudden I've an inaccessible folder with Dovecot 2.2.27 (c0f36b0) from Debian Jessy backports. $ doveadm mailbox list -u mail(a)example.com INBOX/Erledigt INBOX/Erledigt/Erledigt INBOX/Versicherung gesendet Sent INBOX However, it is not accessible any more, my IMAP client tells me: "STATUS: Mailbox doesn't exist: INBOX/Erledigt" Also: $ doveadm search -u mail(a)example.com mailbox INBOX/Erledigt doveadm(mail(a)example.com): Error: Couldn't get mailbox 'INBOX/Erledigt' GUID: Mailbox doesn't exist: INBOX/Erledigt Other mailboxes (especially INBOX/Erledigt/Erledigt) are accessible: $ doveadm search -u mail(a)example.com mailbox INBOX/Erledigt/Erledigt 60af0f1964d68d574a480000f94cf17a 346 60af0f1964d68d574a480000f94cf17a 367 ... $ doveadm -f table mailbox status -u mail(a)example.com "messages vsize" "INBOX*" mailbox messages vsize INBOX/Erledigt2 15 25868676 INBOX/Erledigt/Erledigt 4344 6107238270 INBOX 24 36081472 I'm using mdbox and see no errors in syslog from dovecot. Any ideas on what's going on and how I can recover the mails in that folder? -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

2 2

openssl 1.1.0d breaks Android7 TLS connects
by Tributh 14 Feb '17

14 Feb '17

Hi, the actual OpenSSL version detection in dovecot is insufficient. The implementation only checks for SSL_CTRL_SET_ECDH_AUTO. That was effective for OpenSSL 1.0.2, but in 1.1.0 it is removed. Thats the code part: #ifdef SSL_CTRL_SET_ECDH_AUTO /* OpenSSL >= 1.0.2 automatically handles ECDH temporary key parameter selection. */ SSL_CTX_set_ecdh_auto(ssl_ctx, 1); #else /* For OpenSSL < 1.0.2, ECDH temporary key parameter selection must be performed manually. Attempt to select the same curve as that used in the server's private EC key file. Otherwise fall back to the NIST P-384 (secp384r1) curve to be compliant with RFC 6460 when AES-256 TLS cipher suites are in use. This fall back option does however make Dovecot non-compliant with RFC 6460 which requires curve NIST P-256 (prime256v1) be used when AES-128 TLS cipher suites are in use. At least the non-compliance is in the form of providing too much security rather than too little. */ nid = ssl_proxy_ctx_get_pkey_ec_curve_name(set); ecdh = EC_KEY_new_by_curve_name(nid); if (ecdh == NULL) { /* Fall back option */ nid = NID_secp384r1; ecdh = EC_KEY_new_by_curve_name(nid); } if ((curve_name = OBJ_nid2sn(nid)) != NULL && set->verbose_ssl) i_debug("SSL: elliptic curve %s will be used for ECDH and" " ECDHE key exchanges", curve_name); if (ecdh != NULL) { SSL_CTX_set_tmp_ecdh(ssl_ctx, ecdh); EC_KEY_free(ecdh); } #endif The OpenSSL CHANGES file says for version 1.1.0: Changes between 1.0.2h and 1.1.0 [25 Aug 2016] ... ... *) SSL_{CTX_}set_ecdh_auto() has been removed and ECDH is support is always enabled now. If you want to disable the support you should exclude it using the list of supported ciphers. This also means that the "-no_ecdhe" option has been removed from s_server. [Kurt Roeckx] So when the check for OpenSSL 1.1.0 fails, the curve selection will be forced to use secp384r1 like it would be on older versions. This curve change during negotiation breaks the connect for Android7 devices. They are not able to negotiate any ECDHE cipher. The dovecot log shows: ...SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher... but here it is not a cipher problem. Instead it is a curve problem. This is most relevant if the server is suited with an ECDSA-Certificate. Than no TLS negotiation is possible. There should be added a more sufficient check for the OpenSSL version. If using OpenSSL 1.1.0*, the easiest way the have auto curve selection again is to remove the whole check for testing purpose which results in a working auto curve offering installation and allows also Android7 devices again to connect with TLS & ECDHE ciphers. Regards Torsten

1 0

Re: dovecot config for 1500 simultaneous connection
by Rajesh M 14 Feb '17

14 Feb '17

thanks for your help happy to say that the performance dramatically improved after i use the high performance settings from here http://wiki.dovecot.org/LoginProcess grep Login: /var/log/mail.log.1 |wc -l with the mail.log being of a typical, busy day. 412992 i also picked up the imap and pop3 connections during peak hours [root@ns1 domains]# doveadm who | awk '/imap/{m+=$2}/pop3/{n+=$2}END{print m,n}' username # proto (pids) (ips) max figures i got was 535 for imap and 97 for pop Question 1 i wish to improve the performance further by caching the logins. current the same is kept disable because when user's change passwords then they are not able to immediately login with the new password for some time. How to solve this issue. further to the above. i am planning to put up a large mail server with one of the following options option 1 OS and mailqueue : 2 X 600 gb 15k rpm raid 1 data : 4 X 2000 gb raid 10 for data backup : 2 X 2000 gb raid 10 for backup 32 gb ram option 2 os and mail queue : 4 X 600 gb 15k rpm raid 10 data : 4 X 2000 gb raid 10 for data 32 gb ram i am having the OS and mail queue on primary drives i understand that Raid10 give a faster write and read whereas Raid 1 will have slow writes and fast reads the question is will there be huge performance difference between Raid1 and Raid 10 when it comes small files like mail queue ? thanks rajesh ----- Original Message ----- From: Christian Balzer [mailto:chibi@gol.com] To: dovecot(a)dovecot.org Cc: kevin(a)my.walr.us Sent: Mon, 13 Feb 2017 10:46:13 +0900 Subject: Hello, On Sun, 12 Feb 2017 08:27:21 -0500 KT Walrus wrote: > Thanks for the info. I do have one further question for you. On your servers that are currently handling 50k IMAP sessions, how many users does that correspond to? Since many users will have multiple IMAP sessions on multiple devices, I’d like to hear about some real-world numbers that could be used for budgeting a new project like mine. > Those servers would actually be the wrong ones to look at, as they are primarily accessed by the aforementioned broken client, so the numbers are somewhat skewed. However looking at other servers with a more "normal" user spread things aren't actually too different. The average number of sessions per user tends to be 2. The clear majority (over 50%) only has one session open (people with well behaved and configured clients watching the INBOX mostly). Another 30% has 2 sessions open, again the typical state of this would be clients watching another mailbox besides INBOX, typically SENT. The rest has 3 and more sessions open. The number of sessions could of course be drastically reduced if any client would support IMAP NOTIFY, alas none that I'm aware of do. Lastly no more than 60% of the session seem to be in IDLE at any given time, so my comments about RAM and IMAP hibernation effectiveness stand. > Also, do you use Dovecot IMAP proxies in front of your backend servers? If so, how many IMAP sessions can one proxy server handle (assuming the proxy does authorization using MySQL running on a separate server)? And, could the proxy server be tuned to help in optimizing mostly IDLE backend sessions? > Yes to Dovecot Proxying, of course. No idea about MySQL, with (Open)LDAP nothing is breaking a sweat at an average of 140 logins per second (IMAP and POP) on the 2 proxy servers. If you can fit your entire dataset into RAM it should be fine, my LDAP servers fall into that category and take about 10% of a slow (1.2GHz, 34%, power-save mode) core only to handle the that load (also 2 servers). And the rate of logins/s is what you need to worry about most and optimize for. The proxies will of course have to do the shuffling of data and SSL en/de-coding, but again they're not particular busy with that. The number of sessions comes into play when looking at the number of login processes on the proxies and their memory footprint. An IMAP login process on the proxies in performance mode with a client limit of 1000 will consume about 55MB at most. So assume at least 55KB RAM per session. Read Timo's mail I linked to about IMAP hibernation, AFAIK nothing has happened to make proxies more supportive for this though. Christian > > On Feb 12, 2017, at 1:58 AM, Christian Balzer <chibi(a)gol.com> wrote: > > > > > > Hello, > > > > On Fri, 10 Feb 2017 14:50:03 -0500 KT Walrus wrote: > > > >>> 1. 256GB of real RAM, swap is for chums. > >> > >> Are you sure that 100,000 IMAP sessions wouldn’t work well with SWAP, especially with fast SSD storage (which is a lot cheaper than RAM)? > >> > > > > I'm sure about tax and death, not much else. > > > > But as a rule of thumb I'd avoid swapping out stuff on production servers, > > even if it were to SSDs. > > Incidentally the servers I'm talking about here have their OS and swap on > > Intel DC S3710s (200GB) and the actual storage on plenty of 1.6TB DC > > S3610s. > > > > Relying on the kernel to make swap decisions is likely to result in much > > reduced performance even with fast SWAP when you're overcommitting things > > on that scale. > > > > > > But read on. > > > >> Seems that these IMAP processes are long lived processes (idling most of the time) that don’t need that much of the contents of real memory available for much of the life of the process. I use a database proxy in front of MySQL (for my web apps) so that there can be a large number of TCP connections to the proxy where the frontend requests are queued for execution using a small number of backend connections. > >> > >> Could Dovecot IMAP be re-written to be more efficient so it works more like MySQL (or other scalable data servers) that could handle a million or more IMAP sessions on a server with 32GBs or less of RAM? Those IMAP sessions aren’t doing much most of the time and shouldn’t really average 2MB of active data per session that needs to be resident in main memory at all times. > >> > > See IMAP hibernation: > > https://www.mail-archive.com/dovecot@dovecot.org/msg63429.html <https://www.mail-archive.com/dovecot@dovecot.org/msg63429.html> > > > > I'm going to deploy/test this in production in about 2 months from now, > > but if you look at the link and the consequent changelog entries you'll see > > that it has certain shortcomings and bug fixes in pretty much each release > > after it was introduced. > > > > But this is the correct way to tackle things, not SWAP. > > > > Alas I'm not expecting miracles and if more than 20% of the IMAP sessions > > here will be hibernated at any given time I'd be pleasantly surprised. > > > > Because between: > > > > 1. Finding a sensible imap_hibernate_timeout. > > > > 2. Having well behaved clients that keep idling instead of restarting the > > sequence (https://joshdata.wordpress.com/2014/08/09/how-bad-is-imap-idle/ <https://joshdata.wordpress.com/2014/08/09/how-bad-is-imap-idle/>) > > > > 3. Having lots of mobile clients who either get disconnected (invisible to > > Dovecot) or have aggressive IDLE timers to overcome carrier NAT timeouts > > (a large mobile carrier here times out idle TCP sessions after 2 minutes, > > forcing people to use 1 minute IDLE renewals, making 1. up there a > > nightmare). > > > > 4. Having really broken clients (don't ask, I can't tell) which open IMAP > > sessions, don't put them into IDLE and thus having them expire after 30 > > minutes. > > > > the pool of eligible IDLE sessions isn't as big as it could be, in my case > > at least. > > > >> My mail server isn’t that large yet as I haven’t fully deployed Dovecot outside my own small group yet, but it would be nice if scaling Dovecot IMAP to millions of users wasn’t limited to 50,000 IMAP sessions on a server... > >> > > > > Scaling up is nice and desirable from a cost (rack space, HW) perspective, > > but the scalability of things OTHER than Dovecot as I pointed out plus > > that little detail of failure domains (do you really want half of your > > eggs in one basket?) argue for scaling out after a certain density. > > > > I'm feeling my way there at this time, but expect more than 100k sessions > > per server to be tricky. > > > > Lastly, when I asked about 500k sessions per server here not so long ago, > > ( http://www.dovecot.org/list/dovecot/2016-November/106284.html <http://www.dovecot.org/list/dovecot/2016-November/106284.html> ) > > Timo mentioned that he's not aware of anybody doing more than 50k per > > server, something I got licked already and definitely will go to 100k > > eventually. > > > > Regards, > > > > Christian > >>> On Feb 10, 2017, at 11:07 AM, Christian Balzer <chibi(a)gol.com> wrote: > >>> > >>> On Fri, 10 Feb 2017 07:59:52 -0500 KT Walrus wrote: > >>> > >>>>> 1500 IMAP sessions will eat up about 3GB alone. > >>>> > >>>> Are you saying that Dovecot needs 2MB of physical memory per IMAP session? > >>>> > >>> That depends on the IMAP session, read the mailbox size and index size, > >>> etc. > >>> Some are significantly larger: > >>> --- > >>> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > >>> 1033864 mail 20 0 97600 67m 54m S 0 0.1 0:01.15 imap > >>> --- > >>> > >>> But yes, as somebody who has mailbox servers with 55k+ session the average > >>> is around 1.6MB. > >>> > >>>> If I want to support a max 100,000 IMAP sessions per server, I should configure the server to have at least 200GBs of SWAP? > >>>> > >>> You will want: > >> > >>> 2. Understanding how to tune Dovecot and more importantly the overall > >>> system to such a task (see that PID up there?). > >>> 3. Be willing to deal with stuff like top and ps taking ages to start/run > >>> and others like atop actually killing dovecot (performance wise, not > >>> literally) when doing their obviously flawed cleanup on exit. Some things > >>> clearly do NOT scale well. > >>> > >>> My current goal is to have 100k capable servers that work well, 200k in a > >>> failover scenario, but that won't be particular enjoyable. > >>> > >>> Christian > >>> > >>>>> On Feb 10, 2017, at 3:58 AM, Christian Balzer <chibi(a)gol.com> wrote: > >>>>> > >>>>> On Fri, 10 Feb 2017 01:13:20 +0530 Rajesh M wrote: > >>>>> > >>>>>> hello > >>>>>> > >>>>>> could somebody with experience let me know the dovecot config file settings to handle around 1500 simultaneous connections over pop3 and 1500 connection over imap simultaneously. > >>>>>> > >>>>> > >>>>> Be very precise here, you expect to see 1500 as the result of > >>>>> "doveadm who |grep pop3 |wc -l"? > >>>>> > >>>>> Because that implies an ungodly number of POP3 connects per second, given > >>>>> the typically short duration of these. > >>>>> > >>>>> 1500 IMAP connections (note that frequently a client will have more than > >>>>> the INBOX open and thus have more than one session and thus process on the > >>>>> server) are a much easier proposition, provided they are of the typical > >>>>> long lasting type. > >>>>> > >>>>> So can you put a number to your expected logins per second (both protocols)? > >>>>> > >>>>>> my server > >>>>>> > >>>>>> server configuration > >>>>>> hex core processor, 16 gb ram 1 X 600 gb 15 k rpm for main drive and 2 X 2000 > >>>>>> gb hdd for data (No raid) > >>>>>> > >>>>> No RAID and no other replication like DRBD? > >>>>> Why would you even bother? > >>>>> > >>>>> How many users/mailboxes in total with what quota? > >>>>> > >>>>> 1500 IMAP sessions will eat up about 3GB alone. > >>>>> You will want more memory, simply to keep all relevant SLAB bits (inodes, > >>>>> dentries) in RAM. > >>>>> > >>>>> If you really have several hundreds logins/s, you're facing several > >>>>> bottlenecks: > >>>>> 1. Login processes themselves (easily fixed by high performance mode) > >>>>> 2. Auth processes (that will depend on your backends, method mostly) > >>>>> 3. Dovecot master process (spawning mail processes) > >>>>> > >>>>> The later is a single-threaded process, so it will benefit from a faster > >>>>> CPU core. > >>>>> It can be dramatically improved by enabling process re-usage, see: > >>>>> http://wiki.dovecot.org/PerformanceTuning > >>>>> > >>>>> However that also means more memory usage. > >>>>> > >>>>> > >>>>> > >>>>> Christian > >>>>> > >>>>>> > >>>>>> thanks > >>>>>> rajesh > >>>>>> > >>>>> > >>>>> [snip] > >>>>> -- > >>>>> Christian Balzer Network/Systems Engineer > >>>>> chibi(a)gol.com Global OnLine Japan/Rakuten Communications > >>>>> http://www.gol.com/ > >>>> > >>> > >>> > >>> -- > >>> Christian Balzer Network/Systems Engineer > >>> chibi(a)gol.com <mailto:chibi@gol.com> <mailto:chibi@gol.com <mailto:chibi@gol.com>> Global OnLine Japan/Rakuten Communications > >>> http://www.gol.com/ <http://www.gol.com/> <http://www.gol.com/ <http://www.gol.com/>> > > > > > > -- > > Christian Balzer Network/Systems Engineer > > chibi(a)gol.com <mailto:chibi@gol.com> Global OnLine Japan/Rakuten Communications > > http://www.gol.com/ <http://www.gol.com/> > -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/

2 1

pop3 and dsync master-master replication issue causing duplicate delivery (resolved)
by Burak Seydioglu 14 Feb '17

14 Feb '17

I had opened a thread a while ago in regards to dsync duplicate delivery issues. Here is an update in case anybody else is suffering from this: https://dovecot.org/list/dovecot/2016-April/103973.html We are using an LDAP backend for userdb and passdb lookups and this is causing multiple replication users to be created. Here is the broken setup: ############################################### userdb ############################################### hosts = localhost dn = cn=dovecot,dc... dnpass = PASSWORD ldap_version = 3 base = ou=instances,dc... deref = never scope = subtree user_attrs = \ =home=/mail/spool/hash-%0.2M{ldap:uid}/%{ldap:uid}, \ =mail=maildir:/mail/spool/hash-%0.2M{ldap:uid}/%{ldap:maildrop} user_filter = (&(objectClass=mailUser)(uid=%n)) iterate_attrs = uid=user iterate_filter = (objectClass=mailUser) ############################################### passdsb ############################################### hosts = localhost dn = cn=dovecot,dc=dc... dnpass = PASSWORD ldap_version = 3 base = ou=instances,dc=dc... deref = never scope = subtree pass_attrs = uid=user,userPassword=password, \ =userdb_home=/mail/spool/hash-%0.2M{ldap:uid}/%{ldap:uid}, \ =userdb_mail=maildir:/mail/spool/hash-%0.2M{ldap:uid}/%{ldap:maildrop} pass_filter = (&(objectClass=mailUser)(uid=%n)) ############################################### If you don't specify a user attribute in the userdb configuration, dovecot uses the destination email address to create the replication user in addition to users based on the definitions from iterate_attr and pass_attr entries. At the end, multiple replication users are created for the same mailbox causing deleted messages to re-appear and get delivered multiple times. ############################################### username priority fast sync full sync failed buraktest1 none 02:07:02 02:07:02 - buraktest1(a)buraktest1.domain.com none 02:57:13 02:57:13 - ############################################### One thing to note here is that the behavior does not manifest itself during the first delivery/retrieval/delete cycle. You need to repeat the cycle again to expose the issue. The fix is to define and override the "user" attribute in the userdb configuration: ############################################### userdb ############################################### hosts = localhost dn = cn=dovecot,dc... dnpass = PASSWORD ldap_version = 3 base = ou=instances,dc... deref = never scope = subtree user_attrs = \ =user=%{ldap:uid}, \ =home=/mail/spool/hash-%0.2M{ldap:uid}/%{ldap:uid}, \ =mail=maildir:/mail/spool/hash-%0.2M{ldap:uid}/%{ldap:maildrop} user_filter = (&(objectClass=mailUser)(uid=%n)) iterate_attrs = uid=user iterate_filter = (objectClass=mailUser) ###############################################

1 0

unsubscribe
by jean francois pion 13 Feb '17

13 Feb '17

unsubscribe -- -- JF Pion /*Marisol Touraine, Ministre de la Santé à propos du virus Zika:*/ *"Quand on a un projet de grossesse, il faut avoir des relations sexuelles protégées parce que le virus peut se transmettre par la voie sexuelle. "* Oui, mais…enfin, sérieusement quoi ? ?? elle réfléchit parfois ?? --- L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast. https://www.avast.com/antivirus

1 0

Unable to use encrypted password for imap and pop3
by Davide Marchi 13 Feb '17

13 Feb '17

Hi friends, Following the Workaround tutorial for Jessie (https://workaround.org/ispmail/jessie ) I've set up six month ago my first Postfix email server and all works very fine, except for the ability from the user to encrypt login password. I can use the encrypted login password with smtp (Postfix), but not with pop3 and imap (Dovecot). The certificates are from Letsencrypt. I've read "http://wiki2.dovecot.org/Authentication/Mechanisms#Non-plaintext_authentica…" and set auth_mechanisms = plain login cram-md5 But with no luck, If I try to connect to Dovecot from openssl obtain an error: "Verify return code: 20 (unable to get local issuer certificate)" And now, if I enable on the client (Tunderbird) the encrypted password obtain a message to reinsert the password Here my Dovecot configuration: doveconf -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.5 ext4 auth_mechanisms = plain login cram-md5 apop mail_location = maildir:/var/vmail/%d/%n/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX.Junk { auto = subscribe special_use = \Junk } mailbox INBOX.Trash { auto = subscribe special_use = \Trash } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve } protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/server.sio4.org/fullchain.pem ssl_key = </etc/letsencrypt/live/server.sio4.org/privkey.pem userdb { args = uid=vmail gid=vmail home=/var/vmail/%d/%n driver = static } protocol lmtp { mail_plugins = " sieve" } Could you suggest me where I should look into? Many many thanks! davide

2 1

Problem with Horde "Mailbox does not support mod-sequences"
by Luca Bertoncello 13 Feb '17

13 Feb '17

Hi list! I already asked about this problem about two years ago, but I couldn't solve my problem... Now I have a new Server, with Debian 8 and Dovecot 2.2.13-12 (from Debian repositories) and Horde 5.2.13. When I delete an E-Mail, I always get the error "Mailbox does not support mod-sequences". It results in having the E-Mail not moved to Trash and I must update more times the folder to see the E-Mail moved to Trash... Could someone help me to add this support for mod-sequences? Thanks a lot! Luca Bertoncello (lucabert(a)lucabert.de)

2 2