1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Unreal POP3 Stats

Discussion in 'Plesk 9.x for Linux Issues, Fixes, How-To' started by StvnT, May 11, 2012.

  1. StvnT

    StvnT New Pleskian

    15
    85%
    Joined:
    Jan 6, 2011
    Messages:
    9
    Likes Received:
    0
    [Solved] Unreal POP3 Stats

    A domain has recently started reporting extremely high POP3 Out statistics. Plesk is reporting between 8 and 10 gigabytes of data for our POP3 Out per night! I don't really know how to read the logs but I believe the inflated reporting is caused by a single account on the affected domain. The suspect account - from the logs:

    For comparison, this is another user on the domain:

    If I understand correctly, the user1 account performs a login, transfers 23MB of data and is disconnected after 30 seconds. Whereas the user2 account performs a login, sees no new mail and logs out.

    What could be the problem? Could it be compromised? Could the client have changed settings and we're seeing IMAP traffic instead of POP3 (sorry, I'm not real familiar with these logs)?
     
    Last edited: May 17, 2012
  2. StvnT

    StvnT New Pleskian

    15
    85%
    Joined:
    Jan 6, 2011
    Messages:
    9
    Likes Received:
    0
    Anyone able to offer some insight?
     
  3. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,557
    Likes Received:
    1,242
    Location:
    Novosibirsk, Russia
    Maybe user1 is spammer? :)
     
  4. paulieG

    paulieG Regular Pleskian

    25
     
    Joined:
    Mar 5, 2009
    Messages:
    164
    Likes Received:
    0
    Location:
    Lancaster
    Hi,

    We have seen something similar to this twice, and in both times (one is still ongoing) its been caused by Kayako.

    Kayako gets itself all in a tizz with emails larger than its limits, I think it downloads the email, realises its bigger than its allowed then gives up. Then on the next cycle it downloads the email, realises its bigger than its allowed then gives up (etc etc etc).

    Not saying its the case you have here, but it could be something else with equally poor logic (or just a truly massive email thats somehow ended up in the inbox and times out on download every time),

    Paul
     
  5. StvnT

    StvnT New Pleskian

    15
    85%
    Joined:
    Jan 6, 2011
    Messages:
    9
    Likes Received:
    0
    Thanks for the help Igor and Paulie!

    This only affected the one account so I was thinking either it was something on the clients end (Outlook error/bug/misconfiguration), email backscatter or a compromised account. We've had some problems with large emails before but nothing quite like this.

    I wasn't able to figure out exactly what the problem was but we were able to get it fixed by resetting the password in Plesk and by having the client delete their account in Outlook. Not insightful into the cause of the problem but it worked for us.
     
Loading...