The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Emails taking a long time since 11.40 upgrade

Discussion in 'E-mail Discussions' started by Legin76, Oct 16, 2013.

  1. Legin76

    Legin76 Well-Known Member

    Joined:
    Dec 11, 2007
    Messages:
    151
    Likes Received:
    1
    Trophy Points:
    18
    I've got a customer who is having issues with email taking an hour or longer for emails on the same hosting account as well as external emails.

    I've been getting emails from LDF since the update which I initially thought was just LDF picking up something that needed to be ignored, but now I'm wondering if they are connected.

    lfd on xxxx.xxxxxxxxxx.xxx: Excessive resource usage: dovecot (866 (Parent PID:860))

    Time: Wed Oct 16 11:01:03 2013 +0100
    Account: dovecot
    Resource: Process Time
    Exceeded: 84564 > 7200 (seconds)
    Executable: /usr/libexec/dovecot/anvil
    Command Line: dovecot/anvil
    PID: 866 (Parent PID:860)
    Killed: No
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Are you using any third-party applications for email such as MailScanner? If so, please ensure you disable them to ensure they are not the cause of the issue.

    Thank you.
     
  3. Legin76

    Legin76 Well-Known Member

    Joined:
    Dec 11, 2007
    Messages:
    151
    Likes Received:
    1
    Trophy Points:
    18
    Hi

    There is no third party software. They are saying that using their iphones / ipads (imap) they are arriving instantly but on the desktops they are taking up to an hour or so.

    I'm suspecting that their computers are set to collect infrequently. Although it's very coincidental with the dovecot error above.

    Is the dovecot issue anything I need to worry about? I've tried a forced update to cpanel with but am still getting the message.

    Thanks
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    The warning message itself is not from cPanel, but rather from LFD. If Dovecot is running as expected, I recommend posting to the LFD forums to see if any specific setting should be changed in your CSF/LFD configuration.

    Thank you.
     
  5. Legin76

    Legin76 Well-Known Member

    Joined:
    Dec 11, 2007
    Messages:
    151
    Likes Received:
    1
    Trophy Points:
    18
    Thanks.

    I've added the process to the ignore list
     
  6. deeplist

    deeplist Member

    Joined:
    Dec 8, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    Have there been any other developments on this? I upgraded from 11.38.X.X to 11.40.0.12 yesterday and now I'm experiencing the exact same issues.
     
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Could you elaborate on the specific issue you are experiencing? Is it with the LFD alert, or with email taking longer for delivery? If the issue is with email delivery, could you open a support ticket so we can take a closer look and reproduce the issue? You can post the ticket number here so we can update this thread with the outcome.

    Thank you.
     
  8. deeplist

    deeplist Member

    Joined:
    Dec 8, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    From what I can tell, email delivery is fine. I am receiving the same LFD alerts as the OP. I know that I can just add them to the ignore list, but there has to be some reason why I'm getting them now when I wasn't receiving them before the update.. That is what I am trying to figure out.
     
  9. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Dovecot was updated to version 2.2 in cPanel version 11.40. It's possible that ConfigServer may need to make some adjustments in their LFD process scanning to reflect any changes associated with this. You may want to check with the support forums for CSF/LFD to see if it's a flaw in their application.

    Thank you.
     
  10. deeplist

    deeplist Member

    Joined:
    Dec 8, 2010
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    For anybody else who may be wondering, the latest version of csf.pignore contains the following to deal with the LFD messages. So, you can add the follow two entries to csf.pignore and then restart lfd:

    exe:/usr/libexec/dovecot/anvil
    exe:/usr/libexec/dovecot/auth
     
  11. amber7

    amber7 Member

    Joined:
    Sep 20, 2006
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    I am getting 'csf is already at the latest version: v6.37' and there are no such lines in csf.pignore
    Anyway this seems to be an effect of dovecot upgrade and the 2 lines cure the messages.
     
  12. SandPond

    SandPond Registered

    Joined:
    Apr 9, 2013
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Immediately after cPanel 11.40 upgrade my logs are full of errors and my email box full of warnings. These relate to over-utilization of resources by Dovecot:

    EXAMPLE 1: LFD WARNING EMAILS [I am receiving large number of these lfd warning emails]:
    Re: lfd on mydomain.com: Excessive resource usage: dovecot (25152 (Parent PID:25146))
    Time: Fri Nov 8 12:01:03 2013 -0500
    Account: dovecot
    Resource: Process Time
    Exceeded: 73967 > 1800 (seconds)
    Executable: /usr/libexec/dovecot/anvil
    Command Line: dovecot/anvil
    PID: 25152 (Parent PID:25146)
    Killed: No

    EXAMPLE 2: LFD.LOG ENTRIES [A am receiving large numbers of these log entry pairs]:
    Nov 7 21:29:05 vps lfd[26102]: *User Processing* PID:25152 Kill:0 User:dovecot Time:1848 EXE:/usr/libexec/dovecot/anvil CMD:dovecot/anvil
    Nov 7 21:29:06 vps lfd[26102]: *User Processing* PID:25156 Kill:0 User:dovecot Time:1848 EXE:/usr/libexec/dovecot/auth CMD:dovecot/auth

    My cPanel server is "plain Jane". Obviously, cPanel is now creating problems, probably over-utilization of system resources.

    NOTE WELL: THE PROCESS TIME IS SMALL AT SERVER REBOOT, THEN INCREASES WITH EACH WARNING ISSUED. MY LAST WARNING/LOG-ENTRY REPORTED "73967 SECONDS". OBVIOUSLY THERE IS SOME SORT OF A "PROCESS (MEMORY) LEAK" OR "CUMULATIVE/PROGRESS" FAILURE ASSOCIATED WITH THE CPANEL 11.40 UPGRADE.

    I see no point in increasing the execution time threshold because there is no value within reason that would be exceeded by this problem.

    P.S.: All here should also read the cPanel & WHM 11.40 Release Notes. There have been some BIG TICKET changes in cPanel regarding Suhosin and Mod_Security: cPanel & WHM 11.40 Release Notes
     
  13. Metro2

    Metro2 Well-Known Member

    Joined:
    May 24, 2006
    Messages:
    376
    Likes Received:
    10
    Trophy Points:
    18
    Location:
    USA
    cPanel Access Level:
    Root Administrator
    I too am getting the same alerts from LFD since update from 11.38 to 11.4, and although email delivery seems to be OK this is still a concern because:

    I've been using CSF/LFD for years and occasionally after certain cPanel updates these alerts would begin arriving BUT the simple solution was to WHM > Restart Services > IMPA Server (Courier/Dovecot)

    A reason was given for that by ConfigServer that goes something like this:

    And if you examine the PT_DELETED configuration in CSF/LFD you will see this:

    So this feature of CSF/LFD has in fact been very useful over the years because:

    Every so often an update would come along from cPanel which would in turn generate these alerts to let me know to Restart the particular service (whether it be mySQL , FTP Server, IMAP Server, etc...) to get rid of the deleted executable process that was lingering after the update.

    And this always worked for Dovecot up until now with WHM/cPanel 11.4

    Now it seems that the new Dovecot version is creating a deleted executable process that won't go away and just keeps running / building up resource usage when it shouldn't.

    Based on all the above and past experience, it does not seem like a good idea to simply ignore the process in csf.pignore (after all - the process tracking feature is there for a reason and helps us keep things running clean).

    Instead of just blindly ignoring the process in csf.pignore without knowing why the usual proper solution of using WHM > Restart Services method no longer works for the Dovecot process as of WHM 11.4 on Release Tier, I'm going to inquire with ConfigServer to get their take on this. Will post back here if I find out anything helpful.
     
  14. MikeDVB

    MikeDVB Well-Known Member
    PartnerNOC

    Joined:
    Jun 4, 2008
    Messages:
    212
    Likes Received:
    3
    Trophy Points:
    18
    Location:
    Indiana, USA
    I've personally never had to restart a service after an update - if you're having to do so - open a ticket with cPanel and have them give it a look.

    We updated a ton of servers to cPanel 11.40 and we run CSF/LFD on them all and we've not seen any issues with emails being delivered quickly nor have we seen any extra process notices from CSF/LFD.

    That said - we aren't generally running the 'default' CSF/LFD configurations as we've customized the firewalls for our needs.
     
  15. SandPond

    SandPond Registered

    Joined:
    Apr 9, 2013
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    This stops repeating lfd emails (see my former post):

    (1) Edit cfs.pignore:
    cd /etc/csf
    nano csf.pignore
    Add these two lines:
    exe:/usr/libexec/dovecot/anvil
    exe:/usr/libexec/dovecot/auth

    (2) Restart cfs:
    cfs -r

    (3) Restart lfd:
    service lfd restart

    (4) Restart Dovecot:
    /etc/init.d/dovecot restart

    *** NOTE: This is the work-around that others have been using to mitigate the issue. I have not found either a solution or explanation of the actual problem (or problems) with the cPanel 11.40 upgrade (Dovecot/CSF/LFD).
     
  16. meredevelopment

    meredevelopment Registered

    Joined:
    Jul 24, 2013
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    I'm also concerned about just adding the 2 processed to the ignore list. If anyone can explain a bit more about why the processed might be staying alive for so long (mine are at 83834 seconds right now) and whether it's ok for these processes to run for weeks/months.
     
  17. Mysticeti

    Mysticeti Well-Known Member

    Joined:
    Sep 16, 2002
    Messages:
    45
    Likes Received:
    2
    Trophy Points:
    8
    Location:
    Southern NH
    Exactly. A little authoritative guidance from CPanel would be appreciated. Simply adding more entries to csf.pignore could mask a more serious issue in the future.
     
  18. briansol

    briansol Active Member

    Joined:
    Oct 31, 2007
    Messages:
    35
    Likes Received:
    1
    Trophy Points:
    6
    Location:
    ct
    Also in the same boat here. Added the 2 lines to stop my phone form blowing up, but really want to know why this just started happening.
    some of these times are just absurd.
     

    Attached Files:

  19. cjamesrun

    cjamesrun Registered

    Joined:
    Aug 3, 2004
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Having the same issue, and following this thread, is the time out (1800) too low? What changed?
     
  20. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    The name of some of the processes internal to dovecot have changed with dovecot 2.2 improved security modal.

    Services - Dovecot Wiki

    anvil should run continuously and never be terminated except on restart of dovecot.
     
Loading...

Share This Page