User constantly loggin into mail?

[bswinnerton]

Hey everyone,

I am just peeking around in my mail log and noticed that I have one of my users that is almost always logging in and out of imap. Here is a portion of the log, Should I be worried?

Mar 22 21:31:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:31:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:32:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:32:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:32:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:33:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:33:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:33:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:34:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:34:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:34:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:35:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:35:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:35:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:36:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:36:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:36:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:37:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:37:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:37:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:38:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:38:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:38:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:39:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:39:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:39:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:40:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:40:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:40:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:41:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:41:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:41:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:42:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:42:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:42:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:43:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:43:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:43:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:44:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:44:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:44:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:45:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:45:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:45:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:46:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:46:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:46:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0
Mar 22 21:47:59 webserver imapd: Connection, ip=[::ffff:127.0.0.1]
Mar 22 21:47:59 webserver imapd: LOGIN, user=domain.com_user, ip=[::ffff:127.0.0.1], protocol=IMAP
Mar 22 21:47:59 webserver imapd: LOGOUT, user=domain.com_user, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=46, sent=432, time=0

..The log goes back quite a ways.

[falko]

That user probably configured his email client to check for mails every minute. If this causes a problem for your server (load-wise), you should contact that user and ask him to stop this.

[bswinnerton]

I suppose that he could have just left the webmail client open all day, it was just a little disturbing to see, I didn't know if something happened.

Thanks Falko!