Skip to main content

Hi CPU usage of dovecot/anvil

Daniel Santos

Hi, 
I've been seeing a very high cpu usage from dovecot/anvil

If I restart dovecot, it normalizes but I need to debug this to check the reason.

How can I debug dovecot/anvil ?

Comments

27 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  Could you let me know specifically how you're seeing that high usage? 

    The first thing I could check would be /var/log/maillog to see if your server is facing unusual mail activity.  If there are a lot of IPs accessing the machine it would get logged there, and that could increase the usage.

    It would also be good to see if there is spam being sent from your machine.  You can try running this command to see if there are a lot of emails being sent from a file or script on your system:

    awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr
    0
  • cpanzy

    I have to restart IMAP about once every week or 2, on each of my 3 cpanel production servers, due to the anvil process using 100% CPU. If I don't restart IMAP then the anvil process will stay at 100% for several days. This only started happening around 3 months ago. It doesn't seem to affect anything it's just annoying seeing the anvil process at the top of top.

    0
  • Allen Daniels

    I have also been seeing this on all the servers we manage. Issue started around the same time as the cPanel 132 update in January, when CFS stopped blocking POP3/IMAP failed connections. It does not happen everyday, but does occur from time to time.

    I suspect, because CFS is not blocking the multiple failed connections, it is causing  dovecot/anvil to run high, when it gets hit with a number of these failed connections.

    Just my thoughts on the matter.

     

    0
  • Daniel Santos

    Could you let me know specifically how you're seeing that high usage? 

    I see this in using top

    I don't see excess email being sent

    I don't see too much usage on /var/maillog so, doesn't seem to be attacks of nothing like that

    I do have a mail node attached to this server with all of the proxies involved but I don't see too much usage in that either

    I do have these errors but not sure if they're related, as I have them now and I don't have high usage at this moment: 


    dovecot[2356548]: auth(admin@XXXXXXX.pt,182.78.64.150,sasl:plain): Error: policy: Policy server HTTP error: Absolute request timeout expired (Request queued 2.000 secs ago, 1 send attempts in 2.000 secs, 2.001 in other ioloops)

    I don't remember seeing these errors on other servers but it can be that this has the most recent Cpanel & Dovecot and others don't.

    I agree with other comments that it started around 3 months ago.

    0
  • cPRex Jurassic Moderator

    Thanks for the additional details.  We've been recommending that users actually increase the allotted memory usage for the Dovecot service to see if that helps lower the CPU usage.  Can you try that to see if that changes the behavior at all?

    https://support.cpanel.net/hc/en-us/articles/360055822813-How-to-increase-memory-limit-for-Dovecot-POP3-and-IMAP-processes

    -1
  • Pedro Fernandes

    I also notice this issue in around 5 different servers, and strange, was also after recent cPanel updates - around january. I don't think is only a issue of emails sent or autentication issues, but some recent update.

    Increase the memory for Dovecot processes didn't solve the issue. Can't point if it helps, since the issue happens very randomly - can be 2-3 weeks without issues or 2-3 days until appears again.

    There is nothing in the mail log that appears out of the normal behaviour. The process itself appears to be just using CPU, not even write/read a lot of the disk.

    1
  • kj

    Following this thread. I also see this issue on multiple servers since a few weeks; anvil/

    ksoftirqd using all the CPU.
    0
  • Juanzo

    Same here, dovecot load high on several servers, after recent cPanel updates.

    0
  • Vedhan
    • Edited

    Dear Team

    Same problem 23 March 2026 update. we facing same problem cpanel LTS
    Past 5 year no issues..
    Even now our mail server volume is low compare previous...suddenly CPU usages very high..
    Edit mail service manager temporarily problem solve. Then after few days CPU usages high

    Any solutions

    -1
  • cPRex Jurassic Moderator

    Vedhan - are you able to create a ticket so this can be investigated?

    0
  • Darryl

    Seeing the same issue here across multiple servers, strace shows infinitely looping epoll_wait e.g.:

     

    epoll_wait(8, [{events=EPOLLIN|EPOLLHUP, data={u32=510802272, u64=94360942295392}}, {events=EPOLLIN|EPOLLHUP, data={u32=510779552, u64=94360942272672}}], 22, 24771) = 2

    0
  • Thiago Voltolini
    • Edited

    Same behavior, epoll_wait:

    epoll_wait(8, [{events=EPOLLIN|EPOLLHUP, data={u32=2232167840, u64=94701966077344}}], 17, 24664) = 1
    epoll_wait(8, [{events=EPOLLIN|EPOLLHUP, data={u32=2232167840, u64=94701966077344}}], 17, 24664) = 1
    epoll_wait(8, [{events=EPOLLIN|EPOLLHUP, data={u32=2232167840, u64=94701966077344}}], 17, 24664) = 1
    epoll_wait(8, [{events=EPOLLIN|EPOLLHUP, data={u32=2232167840, u64=94701966077344}}], 17, 24664) = 1
    epoll_wait(8, [{events=EPOLLIN|EPOLLHUP, data={u32=2232167840, u64=94701966077344}}], 17, 24664) = 1
    epoll_wait(8, [{events=EPOLLIN|EPOLLHUP, data={u32=2232167840, u64=94701966077344}}], 17, 24664) = 1

     

    Increasing memory does not seem to help

    Small server, low email volume (3k in a week)

    0
  • cPRex Jurassic Moderator

    If you have already updated the memory allowed for the authentication process, it would be best to create a ticket so we can determine what is happening on the machine.

    0
  • Jamira40

    Hello,

    We are observing same issues on 5 servers.

    0
  • murmaider

    We also have dovecot/anvil using 100% cpu on our servers.

    0
  • Allen Daniels

    We have found that restarting the IMAP service does clear the immediate issue, but it does come back again overtime. Very random!

    0
  • Jamira40

    Diego Silva probably not we observed this months prior.

    0
  • Darryl

    Still ongoing

    0
  • Pedro Fernandes
    • Edited

    This is for sure a bug in the dovecot that should be checked.

    Is not a isolated issue/case.

    0
  • cPRex Jurassic Moderator

    If one of you is able to create a ticket that will be the best option.

    0
  • imorandin

    Same here. I'll create a ticket next time I see the process.

    0
  • imorandin
    • Edited

    By any chance, do all users experiencing this issue also have Imunify360 installed? I have a theory that it could be related to this:

    imunify360-agent config update '{"PAM": {"exim_dovecot_protection": false}}'

    After disabling this protection the problem goes away.

    However, the command restarts Dovecot, so the result is inconclusive (since restarting the service also makes the symptom disappear).

    Please confirm.

    0
  • Pedro Fernandes

    @imorandin 
    I don't have Imunify360 and the issue is there. 

    0
  • murmaider

    I have a few servers without Imunify360 but running cPGuard and they also having the same anvil load issue.


    0
  • imorandin

    Thanks. I submitted a support ticket yesterday, but so far I’ve mostly received a fairly generic “ChatGPT-style” response.

    I’d recommend opening support tickets as well so they start seeing more cases from different environments and hopefully begin investigating it more seriously.

    In the meantime, I’ll probably end up implementing a dirty daily cron job to restart Dovecot haha.

    0
  • Pierre Grandmaison

    I am also seeing this issue as well on at least one server

    0
  • Luis Falcon

    Commenting here to subscribe to this thread.

    Same issue, tail-f /var/log/maillog completely normal, no evidence of brute force, at least none out of the ordinary. Restarting Dovecot clears the issue for a few random days. Millions of epoll_wait

    Regards

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post