Re: cannot login to imap under load - SOLVED

2017-03-29 Thread Gerard Ranke 
On 29-03-17 14:40, Marcus Rueckert wrote:
> On 2017-03-29 13:33:52 +0200, Piper Andreas wrote:
>>> It does indeed run from systemd, so this is what's currently in the
>>> dovecot unit file ( /etc/systemd/system/dovecot.service ):
>>>
>> ...
>>> [Service]
>>> Type=simple
>>> ExecStart=/usr/sbin/dovecot -F
>>> NonBlocking=yes
>>> TasksMax=1
>>> LIMIT_NOFILE=1
>>
>> ...
>>
>> the parameter should be named
>>
>> LimitNOFile=1
>>
>> (without the underscore), see
>> http://man7.org/linux/man-pages/man7/systemd.directives.7.html and
>> http://man7.org/linux/man-pages/man5/systemd.exec.5.html
> 
> Also you dont have to replace the whole service file to achieve this:
> 
> https://discourse.nordisch.org/t/per-service-ulimits/374
> 
>darix
> 

Good point! I did remove the /etc/systemd/system/docevot.service file
and added /etc/systemd/system/dovecot.service.d/limits.conf which reads:

[Service]
TasksMax=1
LimitNOFILE=1

This should survive system upgrades as well.
( The TaskMax setting is to overcome the default 512 from a cgroup
controller that is new for sles12sp2. )

After that it also needed:
systemctl daemon-reload
systemctl restart dovecot

Now dovecot starts up cleanly, and our performance problems are gone.
Thank you all who took the time to answer, your remarks were very
supporting and insightful! It's just what you need when you have a lot
of users breathing down your neck :-)
All the best!

gerard

Re: cannot login to imap under load

2017-03-29 Thread Marcus Rueckert 
On 2017-03-29 13:33:52 +0200, Piper Andreas wrote:
> > It does indeed run from systemd, so this is what's currently in the
> > dovecot unit file ( /etc/systemd/system/dovecot.service ):
> > 
> ...
> > [Service]
> > Type=simple
> > ExecStart=/usr/sbin/dovecot -F
> > NonBlocking=yes
> > TasksMax=1
> > LIMIT_NOFILE=1
> 
> ...
> 
> the parameter should be named
> 
> LimitNOFile=1
> 
> (without the underscore), see
> http://man7.org/linux/man-pages/man7/systemd.directives.7.html and
> http://man7.org/linux/man-pages/man5/systemd.exec.5.html

Also you dont have to replace the whole service file to achieve this:

https://discourse.nordisch.org/t/per-service-ulimits/374

   darix

-- 
   openSUSE - SUSE Linux is my linux
   openSUSE is good for you
   www.opensuse.org

Re: cannot login to imap under load

2017-03-29 Thread Piper Andreas 
Hello,

> 
> It does indeed run from systemd, so this is what's currently in the
> dovecot unit file ( /etc/systemd/system/dovecot.service ):
> 
...
> [Service]
> Type=simple
> ExecStart=/usr/sbin/dovecot -F
> NonBlocking=yes
> TasksMax=1
> LIMIT_NOFILE=1

...

the parameter should be named

LimitNOFile=1

(without the underscore), see
http://man7.org/linux/man-pages/man7/systemd.directives.7.html and
http://man7.org/linux/man-pages/man5/systemd.exec.5.html


--Andreas




smime.p7s
Description: S/MIME Cryptographic Signature

Re: cannot login to imap under load

2017-03-29 Thread Gerard Ranke 
Hi Maria,

It does indeed run from systemd, so this is what's currently in the
dovecot unit file ( /etc/systemd/system/dovecot.service ):

[Unit]
Description=Dovecot IMAP/POP3 email server
After=local-fs.target network.target

[Service]
Type=simple
ExecStart=/usr/sbin/dovecot -F
NonBlocking=yes
TasksMax=1
LIMIT_NOFILE=1

[Install]
WantedBy=multi-user.target

Unfortunately, it doesn't seem to work...
Best,

gerard

On 29-03-17 13:13, María Arrea wrote:
> 
> If you are running dovecot via systemd, increase NOFILES in the
> dovecot startup script
> 
> El 29/03/17 a las 13:07, Gerard Ranke escribió:
>> Hi Steffen,
>>
>> On 29-03-17 12:38, Steffen Kaiser wrote:
>>> On Tue, 28 Mar 2017, Gerard Ranke wrote:
>>>
 dovecot: master: Error: service(imap): fork() failed: Resource
 temporarily unavailable
 dovecot: master: Error: service(imap): command startup failed,
 throttling for 2 secs
>>> check out the ulimits for the Dovecot process.
>>>
>>> -- Steffen Kaiser
>> Here they are:
>>
>> dovecot@mail:~> ulimit -a
>> core file size  (blocks, -c) 0
>> data seg size   (kbytes, -d) unlimited
>> scheduling priority (-e) 0
>> file size   (blocks, -f) unlimited
>> pending signals (-i) 256942
>> max locked memory   (kbytes, -l) 64
>> max memory size (kbytes, -m) unlimited
>> open files  (-n) 1
>> pipe size(512 bytes, -p) 8
>> POSIX message queues (bytes, -q) 819200
>> real-time priority  (-r) 0
>> stack size  (kbytes, -s) 8192
>> cpu time   (seconds, -t) unlimited
>> max user processes  (-u) 256942
>> virtual memory  (kbytes, -v) unlimited
>> file locks  (-x) unlimited
>>
>> This looks ok to me, but on startup, I still get:
>>
>> dovecot[9309]: Warning: fd limit (ulimit -n) is lower than required
>> under max. load (1024 < 1), because of service auth { client_limit }
>>
>> Strange thing is that dovecot still complains about the fd limit being
>> 1024, while I set it to 1. And how can a ulimit be too low 'because
>> of service auth'? I don't get that at all. Thanks for your interest!
>>
>> gerard
> 
>

Re: cannot login to imap under load

2017-03-29 Thread Gerard Ranke 
On 29-03-17 13:12, chaouche yacine wrote:
> Could it be that dovecot is being started from a container ?
>   -- Yassine
>  

No, it's just a service on a VM...
Best,

gerard

Re: cannot login to imap under load

2017-03-29 Thread chaouche yacine 
Could it be that dovecot is being started from a container ?
  -- Yassine
 

On Wednesday, March 29, 2017 12:08 PM, Gerard Ranke  
wrote:
 

 Hi Steffen,

On 29-03-17 12:38, Steffen Kaiser wrote:
> On Tue, 28 Mar 2017, Gerard Ranke wrote:
> 
>> dovecot: master: Error: service(imap): fork() failed: Resource
>> temporarily unavailable
>> dovecot: master: Error: service(imap): command startup failed,
>> throttling for 2 secs
> 
> check out the ulimits for the Dovecot process.
> 
> -- Steffen Kaiser

Here they are:

dovecot@mail:~> ulimit -a
core file size          (blocks, -c) 0
data seg size          (kbytes, -d) unlimited
scheduling priority            (-e) 0
file size              (blocks, -f) unlimited
pending signals                (-i) 256942
max locked memory      (kbytes, -l) 64
max memory size        (kbytes, -m) unlimited
open files                      (-n) 1
pipe size            (512 bytes, -p) 8
POSIX message queues    (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time              (seconds, -t) unlimited
max user processes              (-u) 256942
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

This looks ok to me, but on startup, I still get:

dovecot[9309]: Warning: fd limit (ulimit -n) is lower than required
under max. load (1024 < 1), because of service auth { client_limit }

Strange thing is that dovecot still complains about the fd limit being
1024, while I set it to 1. And how can a ulimit be too low 'because
of service auth'? I don't get that at all. Thanks for your interest!

gerard

Re: cannot login to imap under load

2017-03-29 Thread Gerard Ranke 
Hi Steffen,

On 29-03-17 12:38, Steffen Kaiser wrote:
> On Tue, 28 Mar 2017, Gerard Ranke wrote:
> 
>> dovecot: master: Error: service(imap): fork() failed: Resource
>> temporarily unavailable
>> dovecot: master: Error: service(imap): command startup failed,
>> throttling for 2 secs
> 
> check out the ulimits for the Dovecot process.
> 
> -- Steffen Kaiser

Here they are:

dovecot@mail:~> ulimit -a
core file size  (blocks, -c) 0
data seg size   (kbytes, -d) unlimited
scheduling priority (-e) 0
file size   (blocks, -f) unlimited
pending signals (-i) 256942
max locked memory   (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files  (-n) 1
pipe size(512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority  (-r) 0
stack size  (kbytes, -s) 8192
cpu time   (seconds, -t) unlimited
max user processes  (-u) 256942
virtual memory  (kbytes, -v) unlimited
file locks  (-x) unlimited

This looks ok to me, but on startup, I still get:

dovecot[9309]: Warning: fd limit (ulimit -n) is lower than required
under max. load (1024 < 1), because of service auth { client_limit }

Strange thing is that dovecot still complains about the fd limit being
1024, while I set it to 1. And how can a ulimit be too low 'because
of service auth'? I don't get that at all. Thanks for your interest!

gerard

Re: cannot login to imap under load

2017-03-29 Thread Steffen Kaiser 

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tue, 28 Mar 2017, Gerard Ranke wrote:


dovecot: master: Error: service(imap): fork() failed: Resource
temporarily unavailable
dovecot: master: Error: service(imap): command startup failed,
throttling for 2 secs


check out the ulimits for the Dovecot process.

- -- 
Steffen Kaiser

-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQEVAwUBWNuOn3z1H7kL/d9rAQIj1AgAxH8id+JVGJ7YBVKQkSOfb2N160UNRkNo
hZ/6HLPfI3pBIzypccvvV+rHtv8pxvURjG1fbAoDBaMlmDWau0gMFJwepBunuEYx
gBQGtrBvsABV2nv5kagP5V8TJjzLZplk4/vz0YGsOjlz2JhxbgHcLLA2FyQKTXgc
TWGpmcfWUDTQgQeOLVJcfJUBtbdH4MV0JuDCaiVcbtDuWYpWPRWPw+7Gp4gL46X1
orzD9T4+C/80oBtnUV2fERW7ITeRJTgQ3bR1tKYFQmMDJNpQL78G5P06bJB1D8ob
43TO1Ylb/vz4B2+WnM34gKRQcorcNENuuCjLC6Cy1mQ3MK7kjjoZ8Q==
=HW21
-END PGP SIGNATURE-

Re: cannot login to imap under load

2017-03-28 Thread chaouche yacine 
Hello Gerard !

On Tuesday, March 28, 2017 4:55 PM, Gerard Ranke  wrote:> 
dovecot: master: Error: service(imap): fork() failed: Resource
>
>temporarily unavailable
>
>dovecot: master: Error: service(imap): command startup failed,
>
>throttling for 2 secs
>
>
>Note thate we our users almost exclusively use imap. Normally we would
>
>have some 7 or 800 imap processes running and only a few pop3.



Could it be an OS (or VM) limit on the number of processes you can create ? 


  -- Yassine.