Too many Dovecot-related Processes

Avatar
InMotionFans
  • Answered
Hello, everyone.

Two weeks ago, I noticed high load on my server. By filtering the processes I can see that the process that is most repeated is:

/usr/local/cpanel/bin/dovecot-wrap /usr/libexec/dovecot/checkpassword-reply

The last time there was a high load, there were more than 500 queuing processes of this type. I had to kill them all so that the server again had a stable charge. What is happening? This was not happening a month ago. I have many different accounts on here. Any suggestions?
Replies 1
Avatar
0
IMH Support Agent 5
Hello, Thank you for your question about managing processes in your server. The processes listed appear to be related to the email service sign-in process. It is possibly a bot trying to compromise email accounts. You can kill the processes with the Process Manager in WHM. However, in the long term, I advise checking checking system logs to determine which user is sending the most email and encourage them to change their password. It's possible an account was compromised and is being spoofed. Best, Christopher M.