Emails taking a long time since 11.40 upgrade

Have there been any other developments on this? I upgraded from 11.38.X.X to 11.40.0.12 yesterday and now I'm experiencing the exact same issues.

 

From what I can tell, email delivery is fine. I am receiving the same LFD alerts as the OP. I know that I can just add them to the ignore list, but there has to be some reason why I'm getting them now when I wasn't receiving them before the update.. That is what I am trying to figure out.

 

For anybody else who may be wondering, the latest version of csf.pignore contains the following to deal with the LFD messages. So, you can add the follow two entries to csf.pignore and then restart lfd:

exe:/usr/libexec/dovecot/anvil
exe:/usr/libexec/dovecot/auth

 

I am getting 'csf is already at the latest version: v6.37' and there are no such lines in csf.pignore
Anyway this seems to be an effect of dovecot upgrade and the 2 lines cure the messages.

 

Immediately after cPanel 11.40 upgrade my logs are full of errors and my email box full of warnings. These relate to over-utilization of resources by Dovecot:

EXAMPLE 1: LFD WARNING EMAILS [I am receiving large number of these lfd warning emails]:
Re: lfd on mydomain.com: Excessive resource usage: dovecot (25152 (Parent PID:25146))
Time: Fri Nov 8 12:01:03 2013 -0500
Account: dovecot
Resource: Process Time
Exceeded: 73967 > 1800 (seconds)
Executable: /usr/libexec/dovecot/anvil
Command Line: dovecot/anvil
PID: 25152 (Parent PID:25146)
Killed: No

EXAMPLE 2: LFD.LOG ENTRIES [A am receiving large numbers of these log entry pairs]:
Nov 7 21:29:05 vps lfd[26102]: *User Processing* PID:25152 Kill:0 User:dovecot Time:1848 EXE:/usr/libexec/dovecot/anvil CMD:dovecot/anvil
Nov 7 21:29:06 vps lfd[26102]: *User Processing* PID:25156 Kill:0 User:dovecot Time:1848 EXE:/usr/libexec/dovecot/auth CMD:dovecot/auth

My cPanel server is "plain Jane". Obviously, cPanel is now creating problems, probably over-utilization of system resources.

NOTE WELL: THE PROCESS TIME IS SMALL AT SERVER REBOOT, THEN INCREASES WITH EACH WARNING ISSUED. MY LAST WARNING/LOG-ENTRY REPORTED "73967 SECONDS". OBVIOUSLY THERE IS SOME SORT OF A "PROCESS (MEMORY) LEAK" OR "CUMULATIVE/PROGRESS" FAILURE ASSOCIATED WITH THE CPANEL 11.40 UPGRADE.

I see no point in increasing the execution time threshold because there is no value within reason that would be exceeded by this problem.

P.S.: All here should also read the cPanel & WHM 11.40 Release Notes. There have been some BIG TICKET changes in cPanel regarding Suhosin and Mod_Security: cPanel & WHM 11.40 Release Notes

 

I too am getting the same alerts from LFD since update from 11.38 to 11.4, and although email delivery seems to be OK this is still a concern because:

I've been using CSF/LFD for years and occasionally after certain cPanel updates these alerts would begin arriving BUT the simple solution was to WHM > Restart Services > IMPA Server (Courier/Dovecot)

A reason was given for that by ConfigServer that goes something like this:

And if you examine the PT_DELETED configuration in CSF/LFD you will see this:

So this feature of CSF/LFD has in fact been very useful over the years because:

Every so often an update would come along from cPanel which would in turn generate these alerts to let me know to Restart the particular service (whether it be mySQL , FTP Server, IMAP Server, etc...) to get rid of the deleted executable process that was lingering after the update.

And this always worked for Dovecot up until now with WHM/cPanel 11.4

Now it seems that the new Dovecot version is creating a deleted executable process that won't go away and just keeps running / building up resource usage when it shouldn't.

Based on all the above and past experience, it does not seem like a good idea to simply ignore the process in csf.pignore (after all - the process tracking feature is there for a reason and helps us keep things running clean).

Instead of just blindly ignoring the process in csf.pignore without knowing why the usual proper solution of using WHM > Restart Services method no longer works for the Dovecot process as of WHM 11.4 on Release Tier, I'm going to inquire with ConfigServer to get their take on this. Will post back here if I find out anything helpful.

 

I've personally never had to restart a service after an update - if you're having to do so - open a ticket with cPanel and have them give it a look.

We updated a ton of servers to cPanel 11.40 and we run CSF/LFD on them all and we've not seen any issues with emails being delivered quickly nor have we seen any extra process notices from CSF/LFD.

That said - we aren't generally running the 'default' CSF/LFD configurations as we've customized the firewalls for our needs.

 

This stops repeating lfd emails (see my former post):

(1) Edit cfs.pignore:
cd /etc/csf
nano csf.pignore
Add these two lines:
exe:/usr/libexec/dovecot/anvil
exe:/usr/libexec/dovecot/auth

(2) Restart cfs:
cfs -r

(3) Restart lfd:
service lfd restart

(4) Restart Dovecot:
/etc/init.d/dovecot restart

*** NOTE: This is the work-around that others have been using to mitigate the issue. I have not found either a solution or explanation of the actual problem (or problems) with the cPanel 11.40 upgrade (Dovecot/CSF/LFD).

 

I'm also concerned about just adding the 2 processed to the ignore list. If anyone can explain a bit more about why the processed might be staying alive for so long (mine are at 83834 seconds right now) and whether it's ok for these processes to run for weeks/months.

 

Exactly. A little authoritative guidance from CPanel would be appreciated. Simply adding more entries to csf.pignore could mask a more serious issue in the future.

 

Also in the same boat here. Added the 2 lines to stop my phone form blowing up, but really want to know why this just started happening.
some of these times are just absurd.

 

Having the same issue, and following this thread, is the time out (1800) too low? What changed?