dovecot - Dec 2020 - Imap client with ~7500 imap cmds ~250/~500 read() syscall

> On 30/12/2020 12:06 Marc Roos <m.roos at f1-outsourcing.eu> wrote:
> 
>  
> >
> >> 
> >>  
> >> I am playing a bit with the monitoring, and I have noticed there
is
> one 
> >> client of the chart with ~7500, while the others are between ~17
and
> ~60 
> >> (dovecot_user_num_cmds).
> >> 
> >> I assume this is related to the client, or is it possible
something
> is 
> >> wrong on the server side? Is someone having also such numbers or
is
> this 
> >> really strange. Is it possible to limit these cmd's?
> >
> >Maybe you should look into what command(s) are being executed first?
> >
> >event_exporter cmd_export {
> >  format = json
> >  format_args = time-rfc3339
> >  transport = log
> >}
> >
> >metric imap_command {
> >   event_name = imap_command_finished
> >   filter {
> >      user = anomalous
> >   }
> >   exporter = cmd_export
> >}
> >
> 
> Is there also a way to do this on dovecot 2.2?
With rawlogs, I suppose.

Aki

>>  
>> >
>> >> 
>> >>  
>> >> I am playing a bit with the monitoring, and I have noticed
there
is
>> one
>> >> client of the chart with ~7500, while the others are between
~17
>> >> and
>> ~60
>> >> (dovecot_user_num_cmds).
>> >> 
>> >> I assume this is related to the client, or is it possible 
something
>> is
>> >> wrong on the server side? Is someone having also such numbers
or
is
>> this
>> >> really strange. Is it possible to limit these cmd's?
>> >
>> >Maybe you should look into what command(s) are being executed
first?
>> >
>> >event_exporter cmd_export {
>> >  format = json
>> >  format_args = time-rfc3339
>> >  transport = log
>> >}
>> >
>> >metric imap_command {
>> >   event_name = imap_command_finished
>> >   filter {
>> >      user = anomalous
>> >   }
>> >   exporter = cmd_export
>> >}
>> >
>> 
>> Is there also a way to do this on dovecot 2.2?
>
>With rawlogs, I suppose.
>
If I get this raw log, I am getting huge amount of lists

cut -d ' ' -f2 20201230-181651-16624.out |sort | uniq -c | sort -n

        ..
     17 FLAGS
     20 0
    328 NO
   1284 )
   1284
   9021 OK
 133350 LIST