Mailbox locked user cant access it

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Post Reply
alonzo879
Posts: 4
Joined: Wed Jun 24, 2020 6:52 pm

Mailbox locked user cant access it

Post by alonzo879 »

Hey everyone, this has been happening not that often but lets say every 3 or 4 months. Randomly a user mailbox gets "locked", user can access, emails stay on the queue with "Temporary mail delivery ... " When I check the logs on /opt/zimra/logs/mailbox.log the following shows up.


During that time the CPU goes steadily to 60% and above.

I need to lock the account, stop delivery to that mailbox and eventually of you leave it do it's thing the CPU returns to normal, and mailbox is accessible again.


Any ideas?

imap - com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
at com.zimbra.cs.mailbox.MailboxLock.lock(MailboxLock.java:211)
at com.zimbra.cs.mailbox.MailboxLock.lock(MailboxLock.java:101)
at com.zimbra.cs.mailbox.Mailbox.beginTrackingImap(Mailbox.java:3699)
at com.zimbra.cs.imap.LocalImapMailboxStore.beginTrackingImap(LocalImapMailboxStore.java:98)
at com.zimbra.cs.imap.ImapHandler.startSession(ImapHandler.java:1738)
at com.zimbra.cs.imap.ImapHandler.authenticate(ImapHandler.java:1687)
at com.zimbra.cs.imap.ImapAuthenticatorUser.authenticate(ImapAuthenticatorUser.java:68)
at com.zimbra.cs.security.sasl.Authenticator.authenticate(Authenticator.java:189)
at com.zimbra.cs.security.sasl.PlainAuthenticator.handle(PlainAuthenticator.java:81)
at com.zimbra.cs.imap.ImapHandler.continueAuthentication(ImapHandler.java:383)
at com.zimbra.cs.imap.ImapHandler.continueAuthentication(ImapHandler.java:374)
at com.zimbra.cs.imap.NioImapHandler.processRequest(NioImapHandler.java:120)
at com.zimbra.cs.imap.NioImapHandler.messageReceived(NioImapHandler.java:63)
at com.zimbra.cs.server.NioHandlerDispatcher.messageReceived(NioHandlerDispatcher.java:95)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:716)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:434)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:46)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:796)
at org.apache.mina.filter.codec.ProtocolCodecFilter$ProtocolDecoderOutputImpl.flush(ProtocolCodecFilter.java:427)
at org.apache.mina.filter.codec.ProtocolCodecFilter.messageReceived(ProtocolCodecFilter.java:245)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:434)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:46)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:796)
at com.zimbra.cs.server.NioLoggingFilter.messageReceived(NioLoggingFilter.java:68)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:434)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:46)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:796)
at org.apache.mina.core.filterchain.IoFilterEvent.fire(IoFilterEvent.java:75)
at org.apache.mina.core.session.IoEvent.run(IoEvent.java:63)
at org.apache.mina.filter.executor.OrderedThreadPoolExecutor$Worker.runTask(OrderedThreadPoolExecutor.java:780)
at org.apache.mina.filter.executor.OrderedThreadPoolExecutor$Worker.runTasks(OrderedThreadPoolExecutor.java:772)
at org.apache.mina.filter.executor.OrderedThreadPoolExecutor$Worker.run(OrderedThreadPoolExecutor.java:714)
at java.base/java.lang.Thread.run(Thread.java:834)
dapa6
Posts: 22
Joined: Fri Jun 08, 2018 3:51 pm
Location: Italia

Re: Mailbox locked user cant access it

Post by dapa6 »

Hello
observing the same behavior on 8.8.15P46 just for ios18 users with imap configured and apple mail client.
hisfran
Posts: 36
Joined: Tue Apr 29, 2014 2:10 pm

Re: Mailbox locked user cant access it

Post by hisfran »

I'm not sure if it is the exact same thing but also on a Ubuntu 16 LTS 8.8.15P46 Zimbra installation:
I have one user with 3 email accounts, one of them becomes inaccessible for a few hours every other day.
The other accounts work.

So far when I checked the account was not shown as status = locked in the Zimbra Admin Console.
I'm used to accounts getting locked out, but it is the first time I see this locking issue.

See below: any idea how to fix this?
Zimbra is not supporting 8.8.15 anymore, so I can get no help from Zimbra support.

Any idea welcome.

I can't find any login error for this account in the logs but found some of these:

Code: Select all

ua=Mac OS X Mail/16.0 (3818.100.11.1.3);cid=2139302;] mailbox - transaction canceled because of lock failure
and

Code: Select all

ERROR [ImapSSLServer-46] [ip=10.0.0.101;oip=XX.XX.XX.XX;via=10.0.0.101(nginx/1.20.0);ua=Zimbra/8.8.15
_GA_4652;cid=2122635;] mailbox - Failed to lock mailbox
Apple says: If you see a "transaction canceled because of lock failure" message in your macOS Mail app, it usually means your mailbox is currently locked on the server, preventing access due to potential security concerns like too many failed login attempts, suspicious activity, or server maintenance; essentially, you need to contact your email provider to unlock your account.

Further checking the mailbox.log shows this:

Code: Select all

2024-10-16 04:52:07,494 ERROR [ImapSSLServer-49] [name=user@domain;mid=546;ip=10.0.0.101;oip=XX.XX.XX.XX;via=10.0.0.101(nginx/1.20.0);ua=com.apple.email.
maild/3818.100.11.2.5;cid=2067447;] imap - com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
        at com.zimbra.cs.mailbox.MailboxLock.lock(MailboxLock.java:211) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.mailbox.Mailbox.lock(Mailbox.java:10758) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.imap.ImapListener.updateAccessTime(ImapListener.java:821) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.imap.NioImapHandler.processRequest(NioImapHandler.java:110) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.imap.NioImapHandler.messageReceived(NioImapHandler.java:63) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.server.NioHandlerDispatcher.messageReceived(NioHandlerDispatcher.java:95) ~[zimbrastore.jar:8.8.15_GA_4652]
        at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:1015) ~[mina-core-2.1.6.jar:?]
        at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:650) ~[mina-core-2.1.6.jar:?]
        at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:49) ~[mina-core-2.1.6.jar:?]
dapa6
Posts: 22
Joined: Fri Jun 08, 2018 3:51 pm
Location: Italia

Re: Mailbox locked user cant access it

Post by dapa6 »

Same kind of error observed on 8.8.15P46, what I've noticed is this kind of slow queries on MariaDB just before the first "Failed to lock" error:

Code: Select all

2024-10-17 15:30:24,655 INFO  [ImapSSLServer-24] [name=uset@domain;mid=610;ip=192.168.xx.xx;oip=xx.xx.xx.xx;via=192.168.xx.xx(nginx/1.20.0);ua=com.apple.email.maild/3818.100.11.2.3;cid=29006;] sqltrace - Slow execution ([b]648415ms[/b]): SELECT mi.id, mi.index_id, mi.type FROM mboxgroup10.mail_item AS mi WHERE mi.mailbox_id = 610 AND ((((mi.type = 5 OR mi.type = 6 OR mi.type = 16)) AND (((mi.id >= 126236 AND mi.id <= 126237)) OR ((mi.id >= 126248 AND mi.id <= 126250)) OR ((mi.id >= 126255 AND mi.id <= 126257)) OR ((mi.id >= 126260 AND mi.id <= 126262)) OR ((mi.id >= 126264 AND mi.id <= 126267)) OR ((mi.id >= 126281 AND mi.id <= 126282)) OR ((mi.id >= 126286 AND mi.id <= 126289)) OR ((mi.id >= 126292 AND mi.id <= 126294)) OR ((mi.id >= 126297 AND mi.id <= 126299)) OR ((mi.id >= 126308 AND mi.id <= 126311)) OR ((mi.id >= 126321 AND mi.id <= 126328)) OR ((mi.id >= 126330 AND mi.id <= 126332)) OR ((mi.id >= 126334 AND mi.id <= 126336)) OR ((mi.id >= 126345 AND mi.id.... 
A mailboxd service restart is required to restore user access.

Moving this users to active sync seems to solve the issue.
User avatar
jered
Advanced member
Advanced member
Posts: 66
Joined: Sat Sep 13, 2014 12:35 am
Location: Somerville, MA

Re: Mailbox locked user cant access it

Post by jered »

I believe the surge here is due to a change in Apple iOS 18 Mail, where unreasonable IMAP SEARCH requests are being generated. I've started a new thread: viewtopic.php?t=72998
hisfran
Posts: 36
Joined: Tue Apr 29, 2014 2:10 pm

Re: Mailbox locked user cant access it

Post by hisfran »

Hi Dapa6,

How did you "move this user to Active Sync" ?
Fran


Moving this users to active sync seems to solve the issue.
[/quote]
User avatar
jered
Advanced member
Advanced member
Posts: 66
Joined: Sat Sep 13, 2014 12:35 am
Location: Somerville, MA

Re: Mailbox locked user cant access it

Post by jered »

hisfran wrote: Thu Nov 14, 2024 3:36 pm How did you "move this user to Active Sync" ?
Fran
Mobile Push (Active Sync) is a Professional-edition feature. If you have this license, you can add Zimbra as a "Microsoft Exchange" account rather than an IMAP account. It's not really a valid workaround for most customers unless you have a few spare $100k-1m to deal with a bug.
phoenix
Ambassador
Ambassador
Posts: 27286
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Mailbox locked user cant access it

Post by phoenix »

alonzo879 wrote: Thu Sep 26, 2024 8:25 pm Hey everyone, this has been happening not that often but lets say every 3 or 4 months. Randomly a user mailbox gets "locked", user can access, emails stay on the queue with "Temporary mail delivery ... " When I check the logs on /opt/zimra/logs/mailbox.log the following shows up.
You really should always give your version of ZCS by posting the full output of the following:

Code: Select all

su - zimbra
zmcontrol -v
Regards

Bill

Rspamd: A high performance spamassassin replacement

Per ardua ad astra
Post Reply