[Dovecot] imap-login processes

[Frank Elsner]

On Fri, 16 May 2008 14:47:05 -0400 (EDT) Bryan Polk wrote:
> On Fri, 16 May 2008, Joe Allesi wrote:
> 
> > We had this same problem, and switching to high-performance mode helps.
> > However, finding out which user or application is logging in, and
> > controlling the end-user is the only way to fix it. In our case it was a
> > multi-threaded application that used IMAP (excessively). Monitoring the
> > maillog should help point you in the right direction. Dozens of these per
> > minute should throw up a red-flag:
> >
> 
> Looking back through the log for today we only have about 7-35 
> imap-logins happening per minute, from an assortment of users. There 
> doesn't appear to be one user that's doing more than others. One thing I 
> did notice was entries like this:
> 
> imap-login: Login: user=<faizalmi>, method=PLAIN, rip=127.0.0.1, 
> lip=127.0.0.1, secured
> 
> Is there a reason the rip/lip would say 127.0.0.1 for some small number of 
> users and not others?

Do you have a Web-Interface like SquirrelMail or Horde on the same host?
Our SquirrelMail shows up in this fashion.


--Frank Elsner