dovecot - Dec 2020 - Imap client with ~7500 imap cmds ~250/~500 read() syscall

>
>> 
>>  
>> I am playing a bit with the monitoring, and I have noticed there is 
one 
>> client of the chart with ~7500, while the others are between ~17 and 
~60 
>> (dovecot_user_num_cmds).
>> 
>> I assume this is related to the client, or is it possible something 
is 
>> wrong on the server side? Is someone having also such numbers or is 
this 
>> really strange. Is it possible to limit these cmd's?
>
>Maybe you should look into what command(s) are being executed first?
>
>event_exporter cmd_export {
>  format = json
>  format_args = time-rfc3339
>  transport = log
>}
>
>metric imap_command {
>   event_name = imap_command_finished
>   filter {
>      user = anomalous
>   }
>   exporter = cmd_export
>}
>
Is there also a way to do this on dovecot 2.2?

> On 30/12/2020 12:06 Marc Roos <m.roos at f1-outsourcing.eu> wrote:
> 
>  
> >
> >> 
> >>  
> >> I am playing a bit with the monitoring, and I have noticed there
is
> one 
> >> client of the chart with ~7500, while the others are between ~17
and
> ~60 
> >> (dovecot_user_num_cmds).
> >> 
> >> I assume this is related to the client, or is it possible
something
> is 
> >> wrong on the server side? Is someone having also such numbers or
is
> this 
> >> really strange. Is it possible to limit these cmd's?
> >
> >Maybe you should look into what command(s) are being executed first?
> >
> >event_exporter cmd_export {
> >  format = json
> >  format_args = time-rfc3339
> >  transport = log
> >}
> >
> >metric imap_command {
> >   event_name = imap_command_finished
> >   filter {
> >      user = anomalous
> >   }
> >   exporter = cmd_export
> >}
> >
> 
> Is there also a way to do this on dovecot 2.2?
With rawlogs, I suppose.

Aki