bandwidth exeeded
An account shows very high bandwidth usage at WHM.
cPanel's webalizer/awstats do not show any traces of this at all. On checking detailed bandwidth usage through cpanel of the domain, i found more then 90% bandwidth taken by POP3.
How can I know what exactly has caused the high bandwidth usage ?
Why don't you configure that account in imap rather than pop, and make sure default, catch-all account is disabled and even if it is there, not configured via pop.Originally Posted by Rooney
1 solution works for all problems. Trying harder!
HostMasterTips - Understanding Tech Support
My bad ! forgot to mention, catch-all is already disabled. And the client need pop3 access itself. Thanks Howard.
Can you tell me which log file on the server I should look for the POP3 access to this domain ?
It is /var/log/maillog.
1 solution works for all problems. Trying harder!
HostMasterTips - Understanding Tech Support
No valid information about high traffic there, not even failed login attempts for the domain in question, strange !!!! should I request ticket support with cpanel ?
/var/log/maillog in no way is meant to show amount of bandwidth or size of mails downloaded, it will just record the time of pop sessions created and disconnected. You can just check the IP logging into the email address of that account and tell your client your pop traffic has contributed to your bandwidth.
1 solution works for all problems. Trying harder!
HostMasterTips - Understanding Tech Support
hmmm... there are only very few, maybe less then 10 pop sessions about the problem domain there
No matter how many sessions are there, if POP is the reason for the traffic, then client must have downloaded large amount of emails in these 10 sessions. You have all the logs and evidence to show to your client and if you still want to investigate further, you may check it with the concerned parties, client or maybe cPanel. Best of luck.hmmm... there are only very few, maybe less then 10 pop sessions about the problem domain there
1 solution works for all problems. Trying harder!
HostMasterTips - Understanding Tech Support
Same problem here...
Account has used 17GB of bandwidth. AWstats shows general usage, nothing unusual. If I look at the graphs in the bandwidth section in cpanel I see all of it taken up by POP.
If I check the mail log I see only the usual login and logout entries - the customer is logging in every few minutes.
Noticed a few of these that look unusual...
Mar 12 11:29:15 SERVER pop3d: LOGOUT, user=lp@domain.com, ip=[::ffff:ip.ip.ip.ip], port=[61516], top=0, retr=50881623, rcvd=4486, sent=51671844, time=167
Mar 12 11:34:15 HS100 pop3d: LOGOUT, user=lp@domain.com, ip=[::ffff:ip.ip.ip.ip], port=[61524], top=0, retr=50926514, rcvd=4496, sent=51717413, time=167
..But not hundreds, just a few.
retr=50881623
sent=51671844
Is that in bytes? So its about 6MB?
Hate to drag up a semi-old thread. But this seems to be an issue somewhere (I have 1 account in particular that shows 300mb a day in emails).
Other threads indicate ensuring that /etc/syslog.conf does not contain the maillog entry twice etc. to which I have checked and rechecked.
The rest of the information is as above. Did a solution ever present itself for this issue?
Seems excessive that we have 300mb a day in plain text logs for server output.
Had that problem a few years ago. A user was downloading all the email each time they checked it and never deleted it off the server. As time passed the bandwidth would increase as there would be more emails to download.
I also have experienced this issue with one mail account (at least only one mail account was reported).
Checked the bandwidth, then the maillog... and lots of entries every 5 mins as follows:
<date time removed> philo pop3d: LOGIN, user=<emailadd removed>, ip=[::ffff:<ip removed>], port=[1715]
<date time removed> philo pop3d: DISCONNECTED, user=<emailadd removed>, ip=[::ffff:<ip removed>], port=[1715], top=0, retr=1536404, rcvd=26, sent=1532224, time=20
20 seconds each connection.The retr was the same every time, as well the the sent. This went on for half a day that I can see.
I assume this is the is issue as it aligns with the day the bandwidth was consume in the bandwidth stats. Any reason this would happen...?
@Kurieuo and others this is the exact issue that I'm facing right now.
I have a client that is getting repeated lines like this every 10 minutes or so.
Mar 3 22:10:55 mercury pop3d: LOGOUT, user=email, ip=[::ffff:IP], port=[18321], top=45934, retr=20551653, rcvd=624, sent=20870708, time=70
What does the RETR mean, is that retrieved.
And can someone confirm that that reads 20.5MB
Thanks
Aaron
20 870 708 bytes = 19.9038582 megabytes
source
@Mohit Thanks for that.
Just for closure on large POP3 bandwidth issue I was facing.
As it turns it was someone else was downloading emails from the same account.
Checking IP address in /var/log/maillog confirmed that it was different to the account holders IP that they were using to check mail.
Changing all POP3 passwords and main hosting account passwords has fixed this issue.
Thanks
Aaron
LinkBack URL
About LinkBacks
Reply With Quote