We have been noticing a constant hum of traffic between our IMAP server (Dovecot v1.1.14) and our filers over the past several days. I have narrowed it down to one particular user who has been logged in to IMP/Horde since the problem began (he hadn't logged since we upgraded to Dovecot a week before).
IMP is periodically checking this user's mail every five minutes. Each time it does, the his entire mailbox is being read. I initially thought it might be an indexing problem since I am also seeing messages such as this in the logs:
Corrupted index cache file /local/data/dovecot/indexes/mail/X/XXXXXXXX/.imap/delivery.log/dovecot.index.cache: Broken MIME parts for mail UID 30880
But the in/out bytes being logged by Dovecot indicate that the entire contents of his mailbox are being sent to the client. That is, this user has a particularly large mailbox (~500M) and about 500M are being sent to IMP every five minutes. (Actually, what is the meaning of the above message? He's the only user logging it.)
The user does have some filters defined in IMP, but I can't imagine that it would try to apply them to the entire mailbox each time it is accessed. Surely it would only apply the filters to new messages, right? But I can't think of any other reason why we would be seeing this behaviour, and only for this user.
I have not yet contacted the user as I need something to tell him other than "you're a bandwidth hog". I think the next step is to ask him to disable his filters, but I would prefer not shooting in the dark.
This user alone is adding about 50Mbps of bandwidth; between the time we upgraded to Dovecot (from uw-imap) and he logged in, we were witnessing a huge drop in traffic. He's ruining our graphs! ;-)
Seriously, if anyone has some ideas, please let me know.
Thanks!
-- Chris O'Regan chris@encs.concordia.ca Senior Unix Systems Administrator, Academic IT Services Faculty of Engineering and Computer Science Concordia University, Montreal, Canada