Dovecot - Log flooded with imap-login from some users

mr-manuel

Hello,

lately my server reached its CPU limits. Therefore I checked the system to understand why. After digging a bit, I found out that Dovecot is saturating my CPU. The log is flooded with:

dovecot-mailcow-1  | 2024-02-05T18:04:56.028016312Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-1.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11745
dovecot-mailcow-1  | 2024-02-05T18:04:56.062764521Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-1.tld)<11745><VOmYTKYQNqKsFgH4>: Disconnected: Logged out in=565 out=5309 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.164136877Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-2.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11748
dovecot-mailcow-1  | 2024-02-05T18:04:56.197483819Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-2.tld)<11748><tBWbTKYQQKKsFgH4>: Disconnected: Logged out in=180 out=2452 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.211618983Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-1.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11749
dovecot-mailcow-1  | 2024-02-05T18:04:56.235858116Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-1.tld)<11749><MsabTKYQQqKsFgH4>: Disconnected: Logged out in=180 out=2432 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.347008141Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-2.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11752
dovecot-mailcow-1  | 2024-02-05T18:04:56.398157314Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-2.tld)<11752><H+mdTKYQUKKsFgH4>: Disconnected: Logged out in=565 out=5382 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.402679955Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-1.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11753
dovecot-mailcow-1  | 2024-02-05T18:04:56.431713660Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-1.tld)<11753><UWOeTKYQVqKsFgH4>: Disconnected: Logged out in=565 out=5309 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.551455850Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-2.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11756
dovecot-mailcow-1  | 2024-02-05T18:04:56.580508304Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-1.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11757
dovecot-mailcow-1  | 2024-02-05T18:04:56.584811532Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-2.tld)<11756><qe6gTKYQXKKsFgH4>: Disconnected: Logged out in=180 out=2452 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.605138265Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-1.tld)<11757><fW+hTKYQYKKsFgH4>: Disconnected: Logged out in=180 out=2432 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.730850101Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-2.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11760
dovecot-mailcow-1  | 2024-02-05T18:04:56.757654995Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-1.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11761
dovecot-mailcow-1  | 2024-02-05T18:04:56.783416271Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-2.tld)<11760><S7+jTKYQaqKsFgH4>: Disconnected: Logged out in=565 out=5382 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.789727046Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-1.tld)<11761><kRakTKYQcqKsFgH4>: Disconnected: Logged out in=565 out=5309 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.923053978Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-1.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11764
dovecot-mailcow-1  | 2024-02-05T18:04:56.927161441Z Feb  5 18:04:56 8021b50886c2 dovecot: imap-login: Login: user=<info@domain-2.tld>, method=PLAIN, rip=172.22.1.248, lip=172.22.1.250, mpid=11765
dovecot-mailcow-1  | 2024-02-05T18:04:56.948883442Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-1.tld)<11764><+7imTKYQdqKsFgH4>: Disconnected: Logged out in=180 out=2432 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
dovecot-mailcow-1  | 2024-02-05T18:04:56.962629408Z Feb  5 18:04:56 8021b50886c2 dovecot: imap(info@domain-2.tld)<11765><wcimTKYQeKKsFgH4>: Disconnected: Logged out in=180 out=2452 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0

I don’t know why sometimes the e-Mail clients behave this way. Is there a way to enable a login limit per user? Maybe you have even a better idea how to solve this.

Thanks!

esackbauer

Are these coming from Apple devices?
https://community.mailcow.email/d/1927-update-to-ios16-drains-battery-flooding-mailow-logs/11

mr-manuel

No, in this case they are Android devices.

RealFreeze

I have the same problem with Outlook to sync my mailbox via EAS. Outlook no longer synchronizes and the CPU load on the server increases significantly. The problem has existed since the last update.

DocFraggle

RealFreeze maybe you also ran into this problem and have to downgrade Outlook?

https://answers.microsoft.com/en-us/outlook_com/forum/all/outlook-microsoft-365-stuck-on-waiting-for-server/dbdf60d6-1bdb-4d25-9874-3db79b737220

RealFreeze

DocFraggle Great, thanks for your tip, I guess that’s exactly my problem. Then the only solution is to downgrade or wait until the Redmond company releases a patch.