pop3d: who/why tries to execute it?

[Erik Steffl]

   I just found out that my log directory is bloated - the reason is 
that I have about 20 to 60 MB in /var/log/mail.(err|info|log|warn) 
files. They are filled with messages like these (mail.err):

Aug 23 22:21:30 localhost master[19845]: couldn't exec 
/usr/lib/cyrus/bin/pop3d: No such file or directory
Aug 23 22:21:30 localhost master[344]: got weird response from child: 2

   why would it try to execute pop3d? does it mean somebody is trying to 
connect to my computer using pop3?

   I do not have pop3d installed so it's no wonder it cannot find it, 
that's not a problem, I am just wondering why would it try to execute 
it, only on that particular date (aug 23), I have few log files saved (I 
use logrotate) and none of them contain these error messages. Why would 
cyrus try to execute pop3d 130993 times in one day?

   can I set cyrus so that it doesn't try to execute it even if somebody 
tries to connect to pop3? I already commented out pop3d from 
/etc/cyrus.conf.

   here's what I have installed (the ones with ii at the beginning of 
the line) on debian unstable system:

ii  cyrus21-admin  2.1.8-1        Cyrus mail system (administration tool)
ii  cyrus21-client 2.1.8-1        Cyrus mail system (test clients)
ii  cyrus21-common 2.1.8-1        Cyrus mail system (common files)
ii  cyrus21-dev    2.1.8-1        Cyrus mail system (developer files)
ii  cyrus21-docs   2.1.8-1        Cyrus mail system (documentation files)
ii  cyrus21-imapd  2.1.8-1        Cyrus mail system (IMAP support)
un  cyrus21-murder <none>         (no description available)
un  cyrus21-pop3d  <none>         (no description available)

   as you see cyrus murder and cyros pop3d are not installed.

   here's cyrus config file:

# Debian defaults for Cyrus IMAP server/cluster implementation
# see cyrus.conf(5) for more information
#
# All the tcp services are tcpd-wrapped. see hosts_access(5)
# $Id: cyrus.conf,v 1.11 2002/05/25 11:25:07 hmh Exp $

START {
	# do not delete this entry!
	recover		cmd="/usr/sbin/ctl_cyrusdb -r"

	# this is only necessary if using idled for IMAP IDLE
	# (it is, for Debian's default packaging)
	# [hmh at d.o: disabled due to poor handling by cyrus, I will
	# reenable it in cyrus as soon as I fix master to actually
	# be worth a crap as a process overseer]
	#idled		cmd="idled"

	# this is useful on backend nodes of a Murder cluster
	# it causes the backend to syncronize its mailbox list with
	# the mupdate master upon startup
	#mupdatepush   cmd="/usr/sbin/ctl_mboxlist -m"
}

# UNIX sockets start with a slash and are absolute paths
# you can use a maxchild=# to limit the maximum number of forks of a service
SERVICES {
	# --- Normal cyrus spool, or Murder backends ---
	# add or remove based on preferences
	imap		cmd="imapd" listen="imap" prefork=0 maxchild=100
	imaps		cmd="imapd -s" listen="imaps" prefork=0 maxchild=100
	# pop3 
	cmd="pop3d" listen="pop3" prefork=0 maxchild=50
	# pop3s 
	cmd="pop3d -s" listen="pop3s" prefork=0 maxchild=50

	# At least one form of LMTP is required for delivery
	# (you must keep the Unix socket name in sync with imap.conf)
	lmtp		cmd="lmtpd" listen="localhost:lmtp" prefork=0 maxchild=20
	lmtpunix	cmd="lmtpd" listen="/var/run/cyrus/socket/lmtp" prefork=0 maxchild=20
	# ----------------------------------------------

	# useful if you need to give users remote access to sieve
	# by default, we limit this to localhost in Debian
   	sieve		cmd="timsieved" listen="localhost:sieve" prefork=0 maxchild=100

	# this one is needed for the notification services
	notify		cmd="notifyd" listen="/var/run/cyrus/socket/notify" proto="udp" prefork=1

	# --- Murder frontends -------------------------
	# enable these and disable the matching services above,
	# except for sieve (which deals automatically with Murder)

	# mupdate database service - must prefork at least 1
	# (mupdate slaves)
	#mupdate       cmd="mupdate" listen=2004 prefork=1
	# (mupdate master, only one in the entire cluster)
	#mupdate       cmd="mupdate -m" listen=2004 prefork=1

	# proxies that will connect to the backends
	#imap		cmd="proxyd" listen="imap" prefork=0 maxchild=100
	#imaps		cmd="proxyd -s" listen="imaps" prefork=0 maxchild=100
	#pop3		cmd="pop3proxyd" listen="pop3" prefork=0 maxchild=50
	#pop3s		cmd="pop3proxyd -s" listen="pop3s" prefork=0 maxchild=50
	#lmtp		cmd="lmtpproxyd" listen="lmtp" prefork=1 maxchild=20
	# ----------------------------------------------
}

EVENTS {
	# this is required
	checkpoint	cmd="/usr/sbin/ctl_cyrusdb -c" period=30

	# this is only necessary if using duplicate delivery suppression
	delprune	cmd="/usr/sbin/ctl_deliver -E 3" period=1440

	# this is only necessary if caching TLS sessions
	tlsprune	cmd="/usr/sbin/tls_prune" period=1440
}



   tia,

	erik