dovecot - Dec 2020 - Imap client with ~7500 imap cmds ~250/~500 read() syscall

I am playing a bit with the monitoring, and I have noticed there is one 
client of the chart with ~7500, while the others are between ~17 and ~60 
(dovecot_user_num_cmds).

I assume this is related to the client, or is it possible something is 
wrong on the server side? Is someone having also such numbers or is this 
really strange. Is it possible to limit these cmd's?

> On 30/12/2020 11:46 Marc Roos <m.roos at f1-outsourcing.eu> wrote:
> 
>  
> I am playing a bit with the monitoring, and I have noticed there is one 
> client of the chart with ~7500, while the others are between ~17 and ~60 
> (dovecot_user_num_cmds).
> 
> I assume this is related to the client, or is it possible something is 
> wrong on the server side? Is someone having also such numbers or is this 
> really strange. Is it possible to limit these cmd's?
Maybe you should look into what command(s) are being executed first?

event_exporter cmd_export {
  format = json
  format_args = time-rfc3339
  transport = log
}

metric imap_command {
   event_name = imap_command_finished
   filter {
      user = anomalous
   }
   exporter = cmd_export
}

Aki