[imp] Horde/IMP causing too many open files error?

[Andrew Morgan]

On Mon, 25 Jul 2005, kareemy wrote:

> On 7/25/05, Jan Schneider <jan at horde.org> wrote:
>> Zitat von kareemy <kareemy at gmail.com>:
>>
>>> I checked the access_log and noticed a possible suspicious entry.
>>>
>>> XXX - - [23/Jul/2005:07:26:19 -0500] "GET
>>> /horde/imp/login.php?url=%2Fhorde%2Fservices%2Fportal%2Fsidebar.php%3Fhttpclient%3D1%26amp%3Bnocache%3D74gi8y491ns4
>>> HTTP/1.1" 200 2856
>>>
>>> The same IP address kept performing GET requests on this same url for
>>> several days with about 5 minute intervals. The only difference in the
>>> url were the final 11 characters appeared to change randomly. I
>>> believe that constant berage caused the Too many open files error. The
>>> horde_log file shows tons of
>>>
>>> Jul 23 03:54:55 HORDE [notice] [imp] XXX  [on line 31 of
>>> "/horde/imp/login.php"]
>>>
>>> lines.
>>>
>>> I am having trouble deciphering the GET request. I haven't seen any
>>> url formed that way at all before in my log files. Would the horde or
>>> imp ever normally construct such a url? Under what circumstances?
>>
>> This URL is requested if a client that is not (or no longer) logged in
>> tries to refresh the sidebar in the background. I guess it's some
>> browser kept open while the user left his computer. With a frequency of
>> one request per 5 minutes this shouldn't cause any problems though.
>>
>> Jan.
>
> That is what I suspected. However, I restarted apache and have let
> these requests continue to come in and I've noticed apache is slowly
> but surely using up more and more file descriptors. I am running
> OpenBSD 3.7 and monitoring the number of open files for the www user
> using the fstat command. When I first restarted apache fstat reported
> 111 open files. After about an hour of being bombarded by the same
> request I mentioned above fstat is now reporting that the www user has
> 153 files open. At this rate it seems reasonable that apache will
> exceed its max file descriptor quota within a short period of time
>
> Is there anything in the horde or imp that could cause apache to open
> files and keep them open like this, or is this normal behavior and I
> should simply increase the max file descriptors available to apache?

Perhaps the connections aren't running to completion?  I'd look at the 
output of 'lsof' to see exactly which files are staying open.

 	Andy