I've been noticing a lot of Dovecot shut downs lately. I've brought it to the attention of my hosting provider, but they're not being of much help.

Nov 2 10:07:22 srvr dovecot: master: Warning: Killed with signal 15 (by pid=28444 uid=0 code=kill) 

Then all of the current IMAP accounts logged in will shut down.

Nov 2 10:07:23 srvr dovecot: master: Dovecot v2.2.32 (dfbe293d4) starting up for lmtp, imap, pop3 (core dumps disabled)

I checked the downtime stats on the server and below is the current trend.

- month of August: down 1 time (total 9sec)
- month of September: down 5 times (total 50sec)
- month of October: down 22 times (total 8m 59s)
- month of November, only 7 days in: down 27 times (total 4m 41s)

You can obviously see that Dovecot's downtime has been increasing. I've searched around exhaustively, but can't seem to find any leads.

I'm on CentOS 6.9 and cPanel 66.0.26. Running CSF + LFD. 1H Guardian and Hive is also running.

I disabled CSF and it still happens.

*** UPDATE 11/12/2017 06:06PM EST

I've disabled 1H Guardian monitoring temporarily on Exim, and Dovecot. Based on the monitoring so far, it seems to have resolved the issue. I will monitor a bit more and see if it's truly the case.

*** UPDATE 11/16/2017 07:50PM EST

After several days of monitoring, it definitely was 1H Guardian causing the constant killing of Exim and Dovecot. Though I don't know exactly why this was happening, I disabled the 2 services in the monitoring.

  • Process 28444 running as root sent Dovecot a SIGTERM (which means, kindly asked Dovecot to terminate). Analyze the system log what else happened around that time (any automatic updates, cronjobs ...), maybe you even find log messages by this process ID. – Jens Erat Nov 12 '17 at 8:45
  • And: never post the same question multiple times in the Stack Exchange network, people will get heavily annoyed by the fact the same question will possibly get worked on multiple times (which means, you're wasting those people's time that you want to be helpful). Also have a look at the FAQ of each site to get an understanding what kind of questions are on-topic there. Most of the time, folks here will be reading all relevant sites, anyway. And if you have some external crossposting (still discouraged), disclose it by providing a link. – Jens Erat Nov 12 '17 at 8:49
  • Kind of new to Stack Exchange, so ended up posting it in the wrong place. Deleted it there, and posted it here. Sorry about that. And regarding the PID, it seems to disappear right after shutting dovecot down. No traces of any logs with the PID as well. – enyceexdanny Nov 12 '17 at 9:04
  • Check top + see if your system is swapping. If 100% of swap space is taken, then OOM (Out Of Memory Killer) may be running. Also check your logs to see if other processes are shutdown too. Many times OOM is the hidden culprit for this type of problem. – David Favor Nov 12 '17 at 14:04
  • There is no OOM at all. Swap is barely used. No other processes are being shut down. I've updated original post with some findings. – enyceexdanny Nov 12 '17 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.