[BlueOnyx:20686] Re: Strange fcoemon error

[Lewis Gardner]

Multiple times killing dovecot related processes and completely 
restarting the server have failed to correct the mail problem. So far 
today there are 60 messages related to dovecot restarts.

> Warning: Dovecot process count = 52 processes
> Stopping Dovecot Imap: [  OK  ]
> dovecot: no process killed
> dovecot-auth: no process killed
> Normal: Dovecot process count = 9 processes
> Starting Dovecot Imap: [  OK  ]

There are also a fair number of messages like this:

> Warning: Blocking 80.82.65.150
> Feb 20 07:18:19 bq180 sendmail[5279]: v1KCIJ6e005279: [80.82.65.150] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> Feb 20 07:47:48 bq180 sendmail[14436]: v1KCllfM014436: [80.82.65.150] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> Feb 20 08:17:14 bq180 sendmail[24222]: v1KDHDvt024222: [80.82.65.150] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> Feb 20 08:46:44 bq180 sendmail[1584]: v1KDkhYV001584: [80.82.65.150] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> Feb 20 09:16:13 bq180 sendmail[12529]: v1KEGCM4012529: [80.82.65.150] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

Do you think this server is under some sort of an attack? I still get 
the fcoemon errors and reports from irritated users about slowness due 
to not being able to connect during dovecot restarts.

This server only has one vsite and it only does email. The load is 
usually under .6 on a core duo processor. Almost twice the memory free 
as used.

What to do? Export the site, rebuild the server and import the site?

Thanks!


Michael Stauber wrote:
> Hi Lewis,
> 

> 
>> Yikes! Over 200 Cron <root at xxxx> /usr/local/sbin/dfix.sh messges today!
> 
> Yeah, that'll cause problems and could be related.
> 
>> So I guess that may have some bearing. What do you think? Is Dovecot
>> running out of processes?
> 
> Sometimes Dovecot gets overloaded and some of its related processes
> might stop responding. In that case POP3/IMAP takes a dive and anything
> that tries to connect to those two services of course fails.
> 
> If that happens: Stop Dovecot. Check the process list and see if there
> are processes from Dovecot that are still active. Kill them off and then
> restart Dovecot.
> 
> After such a clean restart it should be good for a long while.
>