Hi,the CLOSE-WAIT connections are a state of the TCP/IP protocol stack. The default time for this state is 120 seconds I think, but you can shorten that, if you really like to. The important thing however is, that those connections shouldn't count towards any limit in the imapd process, as these connections are not owned by the process anymore. If you can use something like "netstat -ntp | grep 993" you should see that those connections do not have a PID anymore.
Am 01.08.26 um 12:04 schrieb Lockywolf:
My cert is fine.
Don't be so sure about that. There might be OCSP checks hanging etc., so you should really investigate the client side too!
Another possible reason is not having enough randomness available for the cryptography. If this is a virtual host or docker container or whatever, try using the daemon/package "haveged" (pitfall on some distros: you have to explicitly use "systemctl enable haveged" after installation to set it to auto-start)
And finally, the handshake for TLS is different handshake, as the process is not really performed by imapd, but OpenSSL or whatever library is used. Therefore it is commonly a different setting, and often not present at all. I cannot find a "tls_handshake_timeout" in imapd.conf. You did set client_timeout in imapd.conf?
In any case, you should activate TCP keepalive as it was mentioned before, because this reliably kills orphaned connections and reduces issues with stateful firewalls. However, the settings that Marco suggested have quite aggressively short time intervals.
net.ipv4.tcp_keepalive_time=25 net.ipv4.tcp_keepalive_intvl=25should do it. It means, after 25 seconds without regular traffic, send a keepalive packet every 25 second. This should kill an orphaned connections within a few minutes, which is totally sufficient. Place it in /etc/sysctl.d/98-keepalive.conf or similar.
Given the FAQ entries in your first mail and the proposed solution: check if it works. In my opinion, there is no need to specifically do this for cyrus, just do it globally for the system via sysctl, it does not hurt and helps every network-related process that might have the same problem.
(Yes, I'm blindly assuming Linux, though something in your mails smells BSDish ;) )
Cheers Matthias
smime.p7s
Description: Kryptografische S/MIME-Signatur
------------------------------------------ Cyrus: Info Permalink: https://cyrus.topicbox.com/groups/info/T22ff1c7d14d4cd97-Mcf1487687f90cb116f1111c2 Delivery options: https://cyrus.topicbox.com/groups/info/subscription
