courier imap problems

[onef]

Like a few others, we're having problems with tcp connect messages from cPanel. Our server is:
WHM 11.26.20
courier imap
CSF installed

The messages we are receiving via email are:
imap failed @ Sat Oct 23 14:36:19 2010. A restart was attempted automagically.
Service Check Method: [tcp connect]

Failure Reason: TCP Transaction Log:
<< * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyright 1998-2008 Double Precision, Inc. See COPYING for distribution information.
>> A001 LOGIN __cpanel__service__auth__imap__oLGnMAWZWLsdpkEXxTbw87VZfr_N0QOO0yfYlvMdT_QgIoDsFrxhyLs9uZbhgJjZ bXxyDfIMgwU85Sm9li0AzWs2SM2DSVIE7vwbINgTX22VYc9ufZJQ5Soc8_B1EClR
<< A001 NO Login failed.
imap: ** [A001 NO Login failed. != A001 OK]

/var/log/maillog has the following messages when this happens:
Oct 23 14:56:39 server imapd: LOGIN, user=cpanel@localhost, ip=[::ffff:127.0.0.1], port=[52675], protocol=IMAP
Oct 23 14:56:40 server imapd: LOGOUT, user=cpanel@localhost, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=12, sent=86, time=1
Oct 23 14:56:40 server imapd: LOGIN FAILED, user=__cpanel__service__auth__imap__sxlM2TQJeeqRUhpQBbNpKx1MHuCp9o1jcyXyPW5cmQvpuqUTIod0LMlOSeCcUvai, ip=[::ffff:127.0.0.1]
Oct 23 14:56:46 server imapd: Disconnected, ip=[::ffff:127.0.0.1], time=26

After looking around the forums, I made the following modifications to mailserver configuration:
max IMAP connections: 200
max IMAP connections per IP: 50
number of auth daemons: 10

I also ran /scripts/upcp and /scripts/courierup --force, to no avail.

This didn't really do much, so out of desperation I went to Tweak Settings and set the "ChkServd TCP checks" option to 5. This made the messages stop coming, and made the maillog happy for a couple hours, so I set it down to 4 and got another message.

While I'm happy that the messages stopped, I would really like to find an actual fix.

[onef]

We didn't get any notifications until early this morning, when the server went down. While bringing the server back up, the data center tech said the /var wouldn't fsck. I had them reboot the server in single user mode and fsck all FS's, and I haven't received any more notifications after booting the system into production.

I believe these issues were related to the FS problems on /var, so I set everything back to default and am waiting to see if I get any more notifications. Will update in a couple days with my findings.

[JawadArshad]

It is commendable that you followed up. It will surely help people facing this same error.

We didn't get any notifications until early this morning, when the server went down. While bringing the server back up, the data center tech said the /var wouldn't fsck. I had them reboot the server in single user mode and fsck all FS's, and I haven't received any more notifications after booting the system into production.

I believe these issues were related to the FS problems on /var, so I set everything back to default and am waiting to see if I get any more notifications. Will update in a couple days with my findings.

[onef]

Thanks JawadArshad, I hope someone finds this info useful at some point.

It's been a few days with no more messages, I would have to say that this is most likely related to the FS issues.