[imp] Horde/IMP causing too many open files error?

[kareemy]

Hello,

I am using Horde 3.0.4 and IMP 4.0.3 on an OpenBSD server I am hosting
for a small workgroup of users. About 2 hours ago I noticed I kept
getting Forbidden errors trying to connect to any webpage hosted on
the server. The apache error_log was filled with:

[error] System: Too many open files (errno: 24)

I checked the access_log and noticed a possible suspicious entry. 

XXX - - [23/Jul/2005:07:26:19 -0500] "GET
/horde/imp/login.php?url=%2Fhorde%2Fservices%2Fportal%2Fsidebar.php%3Fhttpclient%3D1%26amp%3Bnocache%3D74gi8y491ns4
HTTP/1.1" 200 2856

The same IP address kept performing GET requests on this same url for
several days with about 5 minute intervals. The only difference in the
url were the final 11 characters appeared to change randomly. I
believe that constant berage caused the Too many open files error. The
horde_log file shows tons of

Jul 23 03:54:55 HORDE [notice] [imp] XXX  [on line 31 of "/horde/imp/login.php"]

lines.

I am having trouble deciphering the GET request. I haven't seen any
url formed that way at all before in my log files. Would the horde or
imp ever normally construct such a url? Under what circumstances?

I don't believe the requests are malicious in nature. However I am
concerned that such requests seem to have caused apache to open too
many files. I did not perform an lsof before I restarted apache, so I
am not sure how many files it had open or what files they were. But
would such a get request cause apache to open and keep open any files
that could lead to a denial of service? Or maybe this is a red
herring. I would appreciate any insight though.

Thanks,

Kareem Dana