What do you see in the logs? My guess is that someone is trying a brute force auth against you,
-----Original Message----- From: dovecot [mailto:dovecot-bounces@dovecot.org] On Behalf Of Edward Betts Sent: domingo, 21 de Junho de 2015 10:42 To: dovecot@dovecot.org Subject: dovecot auth using 100% CPU
Every few days I find that dovecot auth is using all my CPU.
This is from dovecot 2.2.13, I've just upgraded to 2.2.18
strace -r -p 17956 output:
Process 17956 attached 0.000000 lseek(19, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) 0.000057 getsockname(19, {sa_family=AF_LOCAL, NULL}, [2]) = 0 0.000043 epoll_ctl(15, EPOLL_CTL_ADD, 19, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=850618928, u64=140128453618224}}) = 0 0.000040 write(19, "VERSION\tauth-worker\t1\t0\nDBHASH\t5"..., 97) = -1 EPIPE (Broken pipe) 0.000035 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=17956, si_uid=108} --- 0.000020 epoll_wait(15, {{EPOLLIN|EPOLLHUP, {u32=850618928, u64=140128453618224}}}, 14, 12614) = 1 0.000031 read(19, "", 8192) = 0 0.000026 epoll_ctl(15, EPOLL_CTL_DEL, 19, 7fff77616870) = 0 0.000027 close(19) = 0 0.000029 socket(PF_LOCAL, SOCK_STREAM, 0) = 19 0.000027 fcntl(19, F_GETFL) = 0x2 (flags O_RDWR) 0.000028 fcntl(19, F_SETFL, O_RDWR|O_NONBLOCK) = 0 0.000029 connect(19, {sa_family=AF_LOCAL, sun_path="auth-worker"}, 110) = 0 0.000033 fstat(19, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0 0.000033 lseek(19, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) 0.000026 getsockname(19, {sa_family=AF_LOCAL, NULL}, [2]) = 0 0.000030 epoll_ctl(15, EPOLL_CTL_ADD, 19, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=850618928, u64=140128453618224}}) = 0 0.000035 write(19, "VERSION\tauth-worker\t1\t0\nDBHASH\t5"..., 97) = -1 EPIPE (Broken pipe) 0.000029 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=17956, si_uid=108} --- 0.000015 epoll_wait(15, {{EPOLLIN|EPOLLHUP, {u32=850618928, u64=140128453618224}}}, 14, 12614) = 1 0.000031 read(19, "", 8192) = 0 0.000026 epoll_ctl(15, EPOLL_CTL_DEL, 19, 7fff77616870) = 0 0.000027 close(19) = 0 0.000028 socket(PF_LOCAL, SOCK_STREAM, 0) = 19 0.000036 fcntl(19, F_GETFL) = 0x2 (flags O_RDWR) 0.000026 fcntl(19, F_SETFL, O_RDWR|O_NONBLOCK) = 0 0.000024 connect(19, {sa_family=AF_LOCAL, sun_path="auth-worker"}, 110) = 0 0.000034 fstat(19, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0 0.000030 lseek(19, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) 0.000025 getsockname(19, {sa_family=AF_LOCAL, NULL}, [2]) = 0 0.000031 epoll_ctl(15, EPOLL_CTL_ADD, 19, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=850618928, u64=140128453618224}}) = 0 0.000036 write(19, "VERSION\tauth-worker\t1\t0\nDBHASH\t5"..., 97) = -1 EPIPE (Broken pipe) 0.000030 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=17956, si_uid=108} --- 0.000016 epoll_wait(15, {{EPOLLIN|EPOLLHUP, {u32=850618928, u64=140128453618224}}}, 14, 12614) = 1 0.000031 read(19, "", 8192) = 0 0.000027 epoll_ctl(15, EPOLL_CTL_DEL, 19, 7fff77616870) = 0 0.000028 close(19) = 0
Any ideas what's wrong? The machine is running Debian.
Edward.