Emails taking a long time since 11.40 upgrade

[Legin76]

I've got a customer who is having issues with email taking an hour or longer for emails on the same hosting account as well as external emails.

I've been getting emails from LDF since the update which I initially thought was just LDF picking up something that needed to be ignored, but now I'm wondering if they are connected.

lfd on xxxx.xxxxxxxxxx.xxx: Excessive resource usage: dovecot (866 (Parent PID:860))

Time: Wed Oct 16 11:01:03 2013 +0100
Account: dovecot
Resource: Process Time
Exceeded: 84564 > 7200 (seconds)
Executable: /usr/libexec/dovecot/anvil
Command Line: dovecot/anvil
PID: 866 (Parent PID:860)
Killed: No

 

[cPanelMichael]

Hello

Are you using any third-party applications for email such as MailScanner? If so, please ensure you disable them to ensure they are not the cause of the issue.

Thank you.

 

[Legin76]

Hi

There is no third party software. They are saying that using their iphones / ipads (imap) they are arriving instantly but on the desktops they are taking up to an hour or so.

I'm suspecting that their computers are set to collect infrequently. Although it's very coincidental with the dovecot error above.

Is the dovecot issue anything I need to worry about? I've tried a forced update to cpanel with but am still getting the message.

Thanks

 

[cPanelMichael]

The warning message itself is not from cPanel, but rather from LFD. If Dovecot is running as expected, I recommend posting to the LFD forums to see if any specific setting should be changed in your CSF/LFD configuration.

Thank you.

 

[Legin76]

Thanks.

I've added the process to the ignore list

 

[deeplist]

Have there been any other developments on this? I upgraded from 11.38.X.X to 11.40.0.12 yesterday and now I'm experiencing the exact same issues.

 

[cPanelMichael]

Have there been any other developments on this? I upgraded from 11.38.X.X to 11.40.0.12 yesterday and now I'm experiencing the exact same issues.

Could you elaborate on the specific issue you are experiencing? Is it with the LFD alert, or with email taking longer for delivery? If the issue is with email delivery, could you open a support ticket so we can take a closer look and reproduce the issue? You can post the ticket number here so we can update this thread with the outcome.

Thank you.

 

[deeplist]

Is it with the LFD alert, or with email taking longer for delivery?

From what I can tell, email delivery is fine. I am receiving the same LFD alerts as the OP. I know that I can just add them to the ignore list, but there has to be some reason why I'm getting them now when I wasn't receiving them before the update.. That is what I am trying to figure out.

 

[cPanelMichael]

Dovecot was updated to version 2.2 in cPanel version 11.40. It's possible that ConfigServer may need to make some adjustments in their LFD process scanning to reflect any changes associated with this. You may want to check with the support forums for CSF/LFD to see if it's a flaw in their application.

Thank you.

 

[deeplist]

For anybody else who may be wondering, the latest version of csf.pignore contains the following to deal with the LFD messages. So, you can add the follow two entries to csf.pignore and then restart lfd:

exe:/usr/libexec/dovecot/anvil
exe:/usr/libexec/dovecot/auth

 

[amber7]

I am getting 'csf is already at the latest version: v6.37' and there are no such lines in csf.pignore
Anyway this seems to be an effect of dovecot upgrade and the 2 lines cure the messages.

 

[SandPond]

Immediately after cPanel 11.40 upgrade my logs are full of errors and my email box full of warnings. These relate to over-utilization of resources by Dovecot:

EXAMPLE 1: LFD WARNING EMAILS [I am receiving large number of these lfd warning emails]:
Re: lfd on mydomain.com: Excessive resource usage: dovecot (25152 (Parent PID:25146))
Time: Fri Nov 8 12:01:03 2013 -0500
Account: dovecot
Resource: Process Time
Exceeded: 73967 > 1800 (seconds)
Executable: /usr/libexec/dovecot/anvil
Command Line: dovecot/anvil
PID: 25152 (Parent PID:25146)
Killed: No

EXAMPLE 2: LFD.LOG ENTRIES [A am receiving large numbers of these log entry pairs]:
Nov 7 21:29:05 vps lfd[26102]: *User Processing* PID:25152 Kill:0 User:dovecot Time:1848 EXE:/usr/libexec/dovecot/anvil CMD:dovecot/anvil
Nov 7 21:29:06 vps lfd[26102]: *User Processing* PID:25156 Kill:0 User:dovecot Time:1848 EXE:/usr/libexec/dovecot/auth CMD:dovecot/auth

My cPanel server is "plain Jane". Obviously, cPanel is now creating problems, probably over-utilization of system resources.

NOTE WELL: THE PROCESS TIME IS SMALL AT SERVER REBOOT, THEN INCREASES WITH EACH WARNING ISSUED. MY LAST WARNING/LOG-ENTRY REPORTED "73967 SECONDS". OBVIOUSLY THERE IS SOME SORT OF A "PROCESS (MEMORY) LEAK" OR "CUMULATIVE/PROGRESS" FAILURE ASSOCIATED WITH THE CPANEL 11.40 UPGRADE.

I see no point in increasing the execution time threshold because there is no value within reason that would be exceeded by this problem.

P.S.: All here should also read the cPanel & WHM 11.40 Release Notes. There have been some BIG TICKET changes in cPanel regarding Suhosin and Mod_Security: cPanel & WHM 11.40 Release Notes

 

[Metro2]

I too am getting the same alerts from LFD since update from 11.38 to 11.4, and although email delivery seems to be OK this is still a concern because:

I've been using CSF/LFD for years and occasionally after certain cPanel updates these alerts would begin arriving BUT the simple solution was to WHM > Restart Services > IMPA Server (Courier/Dovecot)

A reason was given for that by ConfigServer that goes something like this:

The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files.

And if you examine the PT_DELETED configuration in CSF/LFD you will see this:

# lfd will report processes, even if they're listed in csf.pignore, if they're
# tagged as (deleted) by Linux. This information is provided in Linux under
# /proc/PID/exe. A (deleted) process is one that is running a binary that has
# the inode for the file removed from the file system directory. This usually
# happens when the binary has been replaced due to an upgrade for it by the OS
# vendor or another third party (e.g. cPanel). You need to investigate whether
# this is indeed the case to be sure that the original binary has not been
# replaced by a rootkit or is running an exploit.
#
# Note: If a deleted executable process is detected and reported then lfd will
# not report children of the parent (or the parent itself if a child triggered
# the report) if the parent is also a deleted executable process
#
# To stop lfd reporting such process you need to restart the daemon to which it
# belongs and therefore run the process using the replacement binary (presuming
# one exists). This will normally mean running the associated startup script in
# /etc/init.d/
#

So this feature of CSF/LFD has in fact been very useful over the years because:

Every so often an update would come along from cPanel which would in turn generate these alerts to let me know to Restart the particular service (whether it be mySQL , FTP Server, IMAP Server, etc...) to get rid of the deleted executable process that was lingering after the update.

And this always worked for Dovecot up until now with WHM/cPanel 11.4

Now it seems that the new Dovecot version is creating a deleted executable process that won't go away and just keeps running / building up resource usage when it shouldn't.

Based on all the above and past experience, it does not seem like a good idea to simply ignore the process in csf.pignore (after all - the process tracking feature is there for a reason and helps us keep things running clean).

Instead of just blindly ignoring the process in csf.pignore without knowing why the usual proper solution of using WHM > Restart Services method no longer works for the Dovecot process as of WHM 11.4 on Release Tier, I'm going to inquire with ConfigServer to get their take on this. Will post back here if I find out anything helpful.

 

[MikeDVB]

I've personally never had to restart a service after an update - if you're having to do so - open a ticket with cPanel and have them give it a look.

We updated a ton of servers to cPanel 11.40 and we run CSF/LFD on them all and we've not seen any issues with emails being delivered quickly nor have we seen any extra process notices from CSF/LFD.

That said - we aren't generally running the 'default' CSF/LFD configurations as we've customized the firewalls for our needs.

 

[SandPond]

This stops repeating lfd emails (see my former post):

(1) Edit cfs.pignore:
cd /etc/csf
nano csf.pignore
Add these two lines:
exe:/usr/libexec/dovecot/anvil
exe:/usr/libexec/dovecot/auth

(2) Restart cfs:
cfs -r

(3) Restart lfd:
service lfd restart

(4) Restart Dovecot:
/etc/init.d/dovecot restart

*** NOTE: This is the work-around that others have been using to mitigate the issue. I have not found either a solution or explanation of the actual problem (or problems) with the cPanel 11.40 upgrade (Dovecot/CSF/LFD).

 

[meredevelopment]

I'm also concerned about just adding the 2 processed to the ignore list. If anyone can explain a bit more about why the processed might be staying alive for so long (mine are at 83834 seconds right now) and whether it's ok for these processes to run for weeks/months.

 

[Mysticeti]

I'm also concerned about just adding the 2 processed to the ignore list. If anyone can explain a bit more about why the processed might be staying alive for so long (mine are at 83834 seconds right now) and whether it's ok for these processes to run for weeks/months.

Exactly. A little authoritative guidance from CPanel would be appreciated. Simply adding more entries to csf.pignore could mask a more serious issue in the future.

 

[briansol]

Also in the same boat here. Added the 2 lines to stop my phone form blowing up, but really want to know why this just started happening.
some of these times are just absurd.

 

[cjamesrun]

Having the same issue, and following this thread, is the time out (1800) too low? What changed?

 

[cPanelNick]

The name of some of the processes internal to dovecot have changed with dovecot 2.2 improved security modal.

Services - Dovecot Wiki

anvil should run continuously and never be terminated except on restart of dovecot.