-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Wed, 22 Mar 2017, Steffen Kaiser wrote:
On Tue, 21 Mar 2017, Bappasaheb Nirmal wrote:
Dovecot log is showing too many POP3 RETR entries which are identical
lines.
I also suspect that it is causing high pop traffic eating most of the
network
bandwidth. Here are some of the lines out of 11009 in a day. Such pattern
is
observed only for few users. dovecot version is 2.1.17.
==============
Mar 20 00:00:07 pi3 dovecot: pop3([email protected]): Disconnected: Logged
out
top=0/0, retr=1/64014, del=0/1429, size=478762716
Mar 20 00:00:07 pi3 dovecot: pop3-login: Login: user=<[email protected]>,
method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=26645, secured,
session=<5CGrmRlLyAAr861h>
Mar 20 00:00:10 pi3 dovecot: pop3([email protected]): Disconnected: Logged
out
top=0/0, retr=1/64014, del=0/1429, size=478762716
Mar 20 00:00:11 pi3 dovecot: pop3-login: Login: user=<[email protected]>,
method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=29932, secured,
session=<k6/gmRlL3gAr861h>
==============
What could be the possible reason?
stating the obvious: it looks like normal POP3 polling with abnormal short
interval.
To verify the guess sniff the network traffic, if the clients open a
connection in that short time. If so, check out the users devices, why the
client is polling so often.
Oh, forgot to mention:
looks like that the client downloads the same message of 456MB each time
again?
- --
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEVAwUBWNIpynz1H7kL/d9rAQKn/ggAkq4s1+BBSacoMGKtTSDuA9Hv5mcdBgLD
XYmdh3vVT9SEBLMI6OqGuaJp7OOEfEjPHqBKgwaxieRh4zIyoRlU1K+4nCqmI2tZ
8BADHyEd9DVJ0JY3PWdV9rAXvrCjX4SUbQwrpG+rCLe2WmuzrPPq5n4+o6AofEBh
LEUIqPdB9q964lymvYr8LW1GHqhcK2y3G1pGVgVpL4hZIQNfTlid0eO2D9CyA2nY
nI3fa4QvjHfDH09OSQsgfQedJqNL/G6QqNaO1jFm/nypZWb31RMOy35Njhee3OiM
nxnxzSqbyaBWSsV1dmRKq8wAnfgXsrUuue6jFepfslBFLoHy7V7i3w==
=VPF9
-----END PGP SIGNATURE-----
