In the example you gave, the ipop3d server with process ID 8994 held and retained the lock from 21:25:01 until 00:28:07, at which point it deleted 2424 messages. This was a normal POP3 logout, not a logout as a result of a disconnection.

As distributed by UW, a POP3 server session that has been idle for 10 minutes will automatically log itself out. In addition, a POP3 server session which has been idle for at least 5 minutes will relenquish the lock to a new POP3 server session which is trying to acquire the lock.

I do not know if your copy of ipop3d came from unmodified UW sources or not. If you have modified ipop3d, or if you obtained ipop3d from a third party, I can not speak for its behavior.

Assuming that your ipop3d is unmodified, or the modifications do not affect ipop3d's behavior in this regard, then the only explanation for the log messages which you report is the following:

A POP3 client connected at 21:35:01 and got the process id 8994 server.

That POP3 client kept the session non-idle throughout this period. Other POP3 clients attempted to connect at 21:43:24, 21:47:40, 22:01:40, and 23:28:01, but could not get the mailbox because the process id 8994 server had activity with the prior 5 minutes. At no time was the server idle for as long as 10 minutes.

Sometime between 21:35:01 and 00:28:07, the client to the process 8994 server sent 2424 POP3 DELE commands to request that messages be deleted when the client logs out with a QUIT command. The client had the option of cancelling these DELE requests with a RSET command, but did not do so.

At 00:28:07, the client connected to the process id 8994 server logged out with a QUIT command.


The upshot is that the responsible party is the POP3 client which was connected to the process ID 8994 server. I do not think that client was Microsoft Outlook; it does not normally behave that way.


This suggests, especially if the problem affects one particular user, that something is going on that you havne't been told.

One possibility is pilot error; sometimes users don't tell you everything until you ferret it out. Another possibility is that the user is being hacked.

Good luck in the detective work.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email protected]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

Reply via email to