Number of imap process increasing over time

[Patrick Boutilier]

On 08/14/2015 11:46 AM, Shaheen Bakhtiar wrote:
> Good morning,
>
> Rebuilt our IMAP server from scratch using Cyrus 2.4.17 on FC22 x86_64. The server is a single process 2.3GH 8 core AMD 64bit with 4G of memory.
>
> Ever since the rebuild we are experience an ever growing number of imapd processes, when we first boot the server we have ~200 using 2.4G of memory. In about 3 to 4 days we have ~1500 imapd processes taking up all available physical memory and all all available swap memory (an additional 4G).
>
> and our logs are filled with messages like:
> Aug 14 06:26:01 postoffice kernel: Out of memory: Kill process 15427 (imapd) score 1 or sacrifice child
> Aug 14 06:26:01 postoffice kernel: Killed process 15427 (imapd) total-vm:179648kB, anon-rss:7756kB, file-rss:672kB
>
> SNMP Graphs of what’s happening:
> https://www.dropbox.com/s/7bnu82h54alrzkz/postoffice%20OOM.png?dl=0
>
> I’m not ruling out a DoS, but the logs from the tcpdump (currently) don’t support that, neither do the SNMP from the router. Checking the IDS, but I find it more than coincidental that this started happening after we upgraded. We had no such issues prior to the upgrade.
>
> Any ideas would be greatly appreciated,
> Shawn
>
> ----
> Cyrus Home Page: http://www.cyrusimap.org/
> List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
> To Unsubscribe:
> https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
>

Try something like this to see if many of the processes are from the 
same IP address and/or user.



for foo in `ps -ef | grep imapd | awk '{ print $2 }'`;do lsof -p 
$foo|egrep 'ESTABLISHED|cyrus.index';done
-------------- next part --------------
A non-text attachment was scrubbed...
Name: boutilpj.vcf
Type: text/x-vcard
Size: 286 bytes
Desc: not available
Url : http://lists.andrew.cmu.edu/pipermail/info-cyrus/attachments/20150814/a5b64332/attachment.vcf