[SOGo] Repeated socket shutdown

[David Kmoch]

Hello,

some users are able to completely block a sogo worker. I have no idea
how they achieve this, but I would rather know how to prevent it on
the server side (except blocking their IP), since it repeats over and
over lasting from several hours to several days.

Apache log:

[proxy_http:error] [pid 18588:tid 139754100205312] (70007)The timeout specified has expired: [client 149.255.xxx.xxx:55788] AH01102: error reading status line from remote server 127.0.0.1:20000, referer: https://webmail.tul.cz/SOGo/so/xxxxx/Mail/view [proxy:error] [pid 18588:tid 139754100205312] [client 149.255.xxx.xxx:55788] AH00898: Error reading from remote server returned by /SOGo/so/xxxxx/Mail/0/folderINBOX/changes, referer: https://webmail.tul.cz/SOGo/so/xxxxx/Mail/view

SOGo log:


14:04:59 sogod [72665]: |SOGo| request took 69.209102 seconds to execute


The worker thread eats %100 CPU during that sequence.

Running version 5.7.1 on RHEL8, LDAP auth, no EAS.

Any idea what can be wrong or what to look for?

--

David Kmoch
Technical University of Liberec
Studentská 2, 461 17 Liberec
+420 485 353 633

14:03:50 sogod [72665]: |SOGo| starting method 'POST' on uri '/SOGo/so/xxxxx/Mail/0/folderINBOX/changes' 14:04:50 sogod [72650]: [WARN] <0x0x55b769ba5580[WOWatchDogChild]> pid 72665 has been hanging in the same request for 1 minutes 14:04:59 sogod [72665]: [ERROR] <0x0x55b76b51a350[WOHttpTransaction]> client disconnected during delivery of response for <WORequest[0x0x55b76b14e210]: method=POST uri=/SOGo/so/xxxxx/Mail/0/folderINBOX/changes app=SOGo rqKey=so rqPath=xxxxx/Mail/0/folderINBOX/changes> (len=328115): the socket was shutdown

smime.p7s
Description: Elektronicky podpis S/MIME