-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Wed, 22 Mar 2017, Steffen Kaiser wrote:
On Tue, 21 Mar 2017, Bappasaheb Nirmal wrote:
Dovecot log is showing too many POP3 RETR entries which are identical lines. I also suspect that it is causing high pop traffic eating most of the network bandwidth. Here are some of the lines out of 11009 in a day. Such pattern is observed only for few users. dovecot version is 2.1.17.
============== Mar 20 00:00:07 pi3 dovecot: pop3(user@example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:07 pi3 dovecot: pop3-login: Login: user=<user@example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=26645, secured, session=<5CGrmRlLyAAr861h> Mar 20 00:00:10 pi3 dovecot: pop3(user@example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:11 pi3 dovecot: pop3-login: Login: user=<user@example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=29932, secured, session=<k6/gmRlL3gAr861h>
What could be the possible reason?
stating the obvious: it looks like normal POP3 polling with abnormal short interval.
To verify the guess sniff the network traffic, if the clients open a connection in that short time. If so, check out the users devices, why the client is polling so often.
Oh, forgot to mention:
looks like that the client downloads the same message of 456MB each time again?
Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEVAwUBWNIpynz1H7kL/d9rAQKn/ggAkq4s1+BBSacoMGKtTSDuA9Hv5mcdBgLD XYmdh3vVT9SEBLMI6OqGuaJp7OOEfEjPHqBKgwaxieRh4zIyoRlU1K+4nCqmI2tZ 8BADHyEd9DVJ0JY3PWdV9rAXvrCjX4SUbQwrpG+rCLe2WmuzrPPq5n4+o6AofEBh LEUIqPdB9q964lymvYr8LW1GHqhcK2y3G1pGVgVpL4hZIQNfTlid0eO2D9CyA2nY nI3fa4QvjHfDH09OSQsgfQedJqNL/G6QqNaO1jFm/nypZWb31RMOy35Njhee3OiM nxnxzSqbyaBWSsV1dmRKq8wAnfgXsrUuue6jFepfslBFLoHy7V7i3w== =VPF9 -----END PGP SIGNATURE-----