0

I'm getting multiple instances of dovecot running on my LAMP server, which is in resulting in LFD reporting with constant emails with the following..

Time:         Mon Jun 13 05:56:34 2011 -0700
Account:      dovecot
Resource:     Process Time
Exceeded:     19811 > 1800 (seconds)
Executable:   /usr/libexec/dovecot/anvil
Command Line: dovecot/anvil [35 connections]
PID:          1621
Killed:       No

Here's a picture of the system processes:

enter image description here

I've tried restarting LFD and CSF, but neither has fixed the problem.

Improve this question
1
  • Fixed that formatting for ya.
    – larsks
    Jun 13, 2011 at 16:09

2 Answers 2

Reset to default
1

If you are running Dovecot to provide POP or IMAP access to mail, it is normal to see many pop3-login and/or imap-login processes. These handle new client connections, and there will generally be one process for each connecting client. Some additional information is here:

Improve this answer
2
  • I don't use the client email service at all, and the only time I can think of that any of my websites use the email service is when it sends out emails for user registrations. With that being said, could this possibly be some kind of DoS/BruteForce attack? Shouldn't these multiple processes die off after X time?
    – Kris Sauquillo
    Jun 13, 2011 at 16:31
  • 2
    If you don't actually need the client email service, you may want to simply disable dovecot. Your applications don't need dovecot for sending email.
    – larsks
    Jun 13, 2011 at 17:01
2

Yes.

Dovecot forks for each session.
Limit with: login_max_processes_count

If server is facing internet, possible brute-force attempt.
Look at netstat source addresses for surety.

May later be of interest: max_mail_processes

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .