Hi List, I've been digging through the archives and haven't found a solution/answer as to some things I've found in our logfile, at least an answer I'm comfortable with.
Here's a snippet of what I've found on a few occasions now. These are logs from 2 pop attempts for a user: Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: I/O error flushing output to client user at 209.79.209.145 [209.79.209.145]: Operation not permitted (1) Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: user at 209.79.209.145 (209.79.209.145): -ERR SIGHUP or SIGPIPE flagged Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: I/O error flushing output to client user at 209.79.209.145 [209.79.209.145]: Operation not permitted (1) Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: user at 209.79.209.145 (209.79.209.145): -ERR POP hangup from pan.directcon.net Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: I/O error flushing output to client user at 209.79.209.145 [209.79.209.145]: Operation not permitted (1) Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: Stats: user 0 0 44 762573 209.79.209.145 209.79.209.145 Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: I/O error flushing output to client user at 209.79.209.145 [209.79.209.145]: Operation not permitted (1) Oct 18 13:52:25 pan /usr/local/sbin/popper[20687]: (v4.0.4) Timing for [EMAIL PROTECTED] (error) auth=0 init=0 clean=0 Oct 18 13:56:10 pan /usr/local/sbin/popper[26149]: spool older than cache file /var/mail/m/l/.user.cache Oct 18 13:56:10 pan /usr/local/sbin/popper[26149]: (v4.0.4) POP login by user "user" at (209.79.209.171) 209.79.209.171 Oct 18 13:56:10 pan /usr/local/sbin/popper[26149]: Stats: user 0 0 0 0 209.79.209.171 209.79.209.171 Oct 18 13:56:10 pan /usr/local/sbin/popper[26149]: (v4.0.4) Timing for [EMAIL PROTECTED] (normal) auth=0 init=0 clean=0 What concerns me is that after the "spool older than cache file" message, this user's mail spool seemed to just vanish. The pop attempts after that message all show 0 messages in the spool where there were 44 messages before. Can anyone offer a possible scenario as to what might have caused this and what part of this sequence might have caused the spool to be deleted or overwritten? Is there any slim chance that the mail spool is lurking around buried somewhere on the server? This user is using Outlook Express as a client and we have already adjusted their Timeout setting, but we are seeing an increasing number of timeout related messages in general in our logfiles. I'm not looking for any magical answer, just hoping someone out there as seen something similar and can offer some feedback so I can learn more from this situation and what needs to happen to prevent further mail loss. Thanks, Lee Terrell
