It just happened again:
root 2904 1 0 14:32 ? 00:00:00 /local/bin/dovecot root 2907 2904 0 14:32 ? 00:00:00 dovecot-auth root 2919 2904 0 14:32 ? 00:00:00 dovecot-auth -w dovecot 7026 2904 0 15:02 ? 00:00:00 [imap-login <defunct>] [and many other imap-login processes, all defunct]
OK, so only imap-login processes are defunct.
That appears to be the case.
BTW, I have 74 connections from our Nessus server to imaps that are in the CLOSE_WAIT state.
If I telnet to "imap", a connection is established but there is no greeting.
But it anyway says "connected to localhost" and only after that hangs?
Correct:
# telnet 0 imap Trying 0.0.0.0... Connected to 0 (0.0.0.0). Escape character is '^]'.
No greeting, and not response if I try to send it commands.
What does it say if you strace dovecot process?
I can't strace the imap-login processes because they are zombies. I have traced the other processes, connecting to localhost:imap and then disconnecting.
# parent dovecot process
Process 2904 attached - interrupt to quit
write(9, "\21\0\0\0\0\0\0\0\1\0\0\0\253\33\0\0\1\1\0\0\0\0\0\0\2"...,
128
# dovecot-auth
Process 2907 attached - interrupt to quit
gettimeofday({1248207577, 195021}, {240, 0}) = 0
gettimeofday({1248207577, 195094}, NULL) = 0
poll([{fd=5, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=7,
events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=0, events=POLLIN|
POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|
POLLHUP|POLLNVAL}], 4, 818) = 0
gettimeofday({1248207578, 23147}, {240, 0}) = 0
gettimeofday({1248207578, 23213}, NULL) = 0
poll([{fd=5, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=7,
events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=0, events=POLLIN|
POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|
POLLHUP|POLLNVAL}], 4, 5000) = 0
gettimeofday({1248207583, 33171}, {240, 0}) = 0
gettimeofday({1248207583, 33238}, NULL) = 0
poll([{fd=5, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=7,
events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=0, events=POLLIN|
POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|
POLLHUP|POLLNVAL}], 4, 5000) = 0
gettimeofday({1248207588, 43177}, {240, 0}) = 0
gettimeofday({1248207588, 43245}, NULL) = 0
poll([{fd=5, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=7,
events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=0, events=POLLIN|
POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|
POLLHUP|POLLNVAL}], 4, 5000) = 0
gettimeofday({1248207593, 53183}, {240, 0}) = 0
gettimeofday({1248207593, 53249}, NULL) = 0
poll(
# dovecot-auth -w
Process 2919 attached - interrupt to quit
gettimeofday({1248207639, 375100}, {240, 0}) = 0
poll(
-- Chris O'Regan chris@encs.concordia.ca Senior Unix Systems Administrator, Academic IT Services Faculty of Engineering and Computer Science Concordia University, Montreal, Canada