Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm getting multiple instances of dovecot running on my LAMP server, which is in resulting in LFD reporting with constant emails with the following..

Time:         Mon Jun 13 05:56:34 2011 -0700
Account:      dovecot
Resource:     Process Time
Exceeded:     19811 > 1800 (seconds)
Executable:   /usr/libexec/dovecot/anvil
Command Line: dovecot/anvil [35 connections]
PID:          1621
Killed:       No

Here's a picture of the system processes: http://i.stack.imgur.com/3ILQj.jpg

I've tried restarting LFD and CSF, but neither has fixed the problem.

share|improve this question
    
Fixed that formatting for ya. –  larsks Jun 13 '11 at 16:09
    
Thanks, larsks. :) –  Kris Sauquillo Jun 13 '11 at 16:35

2 Answers 2

up vote 1 down vote accepted

If you are running Dovecot to provide POP or IMAP access to mail, it is normal to see many pop3-login and/or imap-login processes. These handle new client connections, and there will generally be one process for each connecting client. Some additional information is here:

share|improve this answer
    
I don't use the client email service at all, and the only time I can think of that any of my websites use the email service is when it sends out emails for user registrations. With that being said, could this possibly be some kind of DoS/BruteForce attack? Shouldn't these multiple processes die off after X time? –  Kris Sauquillo Jun 13 '11 at 16:31
2  
If you don't actually need the client email service, you may want to simply disable dovecot. Your applications don't need dovecot for sending email. –  larsks Jun 13 '11 at 17:01

Yes.

Dovecot forks for each session.
Limit with: login_max_processes_count

If server is facing internet, possible brute-force attempt.
Look at netstat source addresses for surety.

May later be of interest: max_mail_processes

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.