[imp] Warning: IMP Messages Filters

[Gottschalk, David]

I'm sending this message to the list, so others can learn from my experiences.

Here at Emory, students and faculty use IMP to access mail stored on backend Cyrus servers. On Tuesday of this week, one of my Cyrus servers started freaking out. The load average went through the roof, and the CPU was being 100% utilized. After some immediate investigation, I discovered that one particular users was doing A LOT of I/O traffic. It appeared they were duplicating every message in their inbox. I contacted the user, and they claimed they weren't doing anything. I killed off the processes, and the load average went down. I suspected that someone else was logging into their account (this has happened before), or he had setup another client (Outlook, Thunderbird, etc) in the past and something goofy was going on. I had him change his password, but the problem re-appeared later that evening.

After the issue appeared again, I suspected something with IMP. I knew this user logged into IMP (we call it Webmail at Emory). He said he had not given anyone his password since it was changed that day. After I deleted over 200K in messages out of his inbox, I was able to login. I immediately looked at his filters, and found the problem. He had setup a filter to move all mail from a particular user to the inbox. Then after that, he had duplicated that message rule. Therefore, all messages that had come from that particular user were being duplicated in his inbox twice! It had created some kind of snowball effect. Better yet, he had the message filters to be run every time he displayed the inbox. Then every time he logged in, it would start duplicating mail. He was never able to login because of the huge volume of messages (the web browser would respond with a page timeout), so he would just close the webpage. The messages would then continue duplicating indefinitely because of the hung session.

It would probably be a good idea if the inbox wasn't a choice in the message filters. Maybe this is something that can change in the future? I wanted everyone to know of this potential issue, so if they run into this problem in the future they would have a easier time finding it.

Thanks.

David Gottschalk
UTS Infrastructure Technology Services
david.gottschalk at emory.edu



This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information.  If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).