pop3d: who/why tries to execute it?

[Ken Murchison]

Quoting Erik Steffl <steffl at bigfoot.com>:

>    I just found out that my log directory is bloated - the reason is 
> that I have about 20 to 60 MB in /var/log/mail.(err|info|log|warn) 
> files. They are filled with messages like these (mail.err):
> 
> Aug 23 22:21:30 localhost master[19845]: couldn't exec 
> /usr/lib/cyrus/bin/pop3d: No such file or directory
> Aug 23 22:21:30 localhost master[344]: got weird response from child: 2
> 
>    why would it try to execute pop3d? does it mean somebody is trying to 
> connect to my computer using pop3?
> 
>    I do not have pop3d installed so it's no wonder it cannot find it, 
> that's not a problem, I am just wondering why would it try to execute 
> it, only on that particular date (aug 23), I have few log files saved (I 
> use logrotate) and none of them contain these error messages. Why would 
> cyrus try to execute pop3d 130993 times in one day?
> 
>    can I set cyrus so that it doesn't try to execute it even if somebody 

Comment out the pop3 entries in /etc/cyrus.conf and restart master (or send it 
a SIGHUP).


> tries to connect to pop3? I already commented out pop3d from 
> /etc/cyrus.conf.

Not according to what I see below.


>    here's what I have installed (the ones with ii at the beginning of 
> the line) on debian unstable system:
> 
> ii  cyrus21-admin  2.1.8-1        Cyrus mail system (administration tool)
> ii  cyrus21-client 2.1.8-1        Cyrus mail system (test clients)
> ii  cyrus21-common 2.1.8-1        Cyrus mail system (common files)
> ii  cyrus21-dev    2.1.8-1        Cyrus mail system (developer files)
> ii  cyrus21-docs   2.1.8-1        Cyrus mail system (documentation files)
> ii  cyrus21-imapd  2.1.8-1        Cyrus mail system (IMAP support)
> un  cyrus21-murder <none>         (no description available)
> un  cyrus21-pop3d  <none>         (no description available)
> 
>    as you see cyrus murder and cyros pop3d are not installed.
> 
>    here's cyrus config file:
> 
> # Debian defaults for Cyrus IMAP server/cluster implementation
> # see cyrus.conf(5) for more information
> #
> # All the tcp services are tcpd-wrapped. see hosts_access(5)
> # $Id: cyrus.conf,v 1.11 2002/05/25 11:25:07 hmh Exp $
> 
> START {
> 	# do not delete this entry!
> 	recover		cmd="/usr/sbin/ctl_cyrusdb -r"
> 
> 	# this is only necessary if using idled for IMAP IDLE
> 	# (it is, for Debian's default packaging)
> 	# [hmh at d.o: disabled due to poor handling by cyrus, I will
> 	# reenable it in cyrus as soon as I fix master to actually
> 	# be worth a crap as a process overseer]
> 	#idled		cmd="idled"
> 
> 	# this is useful on backend nodes of a Murder cluster
> 	# it causes the backend to syncronize its mailbox list with
> 	# the mupdate master upon startup
> 	#mupdatepush   cmd="/usr/sbin/ctl_mboxlist -m"
> }
> 
> # UNIX sockets start with a slash and are absolute paths
> # you can use a maxchild=# to limit the maximum number of forks of a
> service
> SERVICES {
> 	# --- Normal cyrus spool, or Murder backends ---
> 	# add or remove based on preferences
> 	imap		cmd="imapd" listen="imap" prefork=0 maxchild=100
> 	imaps		cmd="imapd -s" listen="imaps" prefork=0 maxchild=100
> 	# pop3 
> 	cmd="pop3d" listen="pop3" prefork=0 maxchild=50
> 	# pop3s 
> 	cmd="pop3d -s" listen="pop3s" prefork=0 maxchild=50
> 
> 	# At least one form of LMTP is required for delivery
> 	# (you must keep the Unix socket name in sync with imap.conf)
> 	lmtp		cmd="lmtpd" listen="localhost:lmtp" prefork=0 
maxchild=20
> 	lmtpunix	cmd="lmtpd" listen="/var/run/cyrus/socket/lmtp" 
prefork=0
> maxchild=20
> 	# ----------------------------------------------
> 
> 	# useful if you need to give users remote access to sieve
> 	# by default, we limit this to localhost in Debian
>    	sieve		cmd="timsieved" listen="localhost:sieve" prefork=0 
maxchild=100
> 
> 	# this one is needed for the notification services
> 	notify		cmd="notifyd" listen="/var/run/cyrus/socket/notify" 
proto="udp"
> prefork=1
> 
> 	# --- Murder frontends -------------------------
> 	# enable these and disable the matching services above,
> 	# except for sieve (which deals automatically with Murder)
> 
> 	# mupdate database service - must prefork at least 1
> 	# (mupdate slaves)
> 	#mupdate       cmd="mupdate" listen=2004 prefork=1
> 	# (mupdate master, only one in the entire cluster)
> 	#mupdate       cmd="mupdate -m" listen=2004 prefork=1
> 
> 	# proxies that will connect to the backends
> 	#imap		cmd="proxyd" listen="imap" prefork=0 maxchild=100
> 	#imaps		cmd="proxyd -s" listen="imaps" prefork=0 maxchild=100
> 	#pop3		cmd="pop3proxyd" listen="pop3" prefork=0 maxchild=50
> 	#pop3s		cmd="pop3proxyd -s" listen="pop3s" prefork=0 
maxchild=50
> 	#lmtp		cmd="lmtpproxyd" listen="lmtp" prefork=1 maxchild=20
> 	# ----------------------------------------------
> }
> 
> EVENTS {
> 	# this is required
> 	checkpoint	cmd="/usr/sbin/ctl_cyrusdb -c" period=30
> 
> 	# this is only necessary if using duplicate delivery suppression
> 	delprune	cmd="/usr/sbin/ctl_deliver -E 3" period=1440
> 
> 	# this is only necessary if caching TLS sessions
> 	tlsprune	cmd="/usr/sbin/tls_prune" period=1440
> }
> 
> 
> 
>    tia,
> 
> 	erik
> 
> 
> 


-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp