Mailbox locked user cant access it

[alonzo879]

Hey everyone, this has been happening not that often but lets say every 3 or 4 months. Randomly a user mailbox gets "locked", user can access, emails stay on the queue with "Temporary mail delivery ... " When I check the logs on /opt/zimra/logs/mailbox.log the following shows up.


During that time the CPU goes steadily to 60% and above.

I need to lock the account, stop delivery to that mailbox and eventually of you leave it do it's thing the CPU returns to normal, and mailbox is accessible again.


Any ideas?

imap - com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
at com.zimbra.cs.mailbox.MailboxLock.lock(MailboxLock.java:211)
at com.zimbra.cs.mailbox.MailboxLock.lock(MailboxLock.java:101)
at com.zimbra.cs.mailbox.Mailbox.beginTrackingImap(Mailbox.java:3699)
at com.zimbra.cs.imap.LocalImapMailboxStore.beginTrackingImap(LocalImapMailboxStore.java:98)
at com.zimbra.cs.imap.ImapHandler.startSession(ImapHandler.java:1738)
at com.zimbra.cs.imap.ImapHandler.authenticate(ImapHandler.java:1687)
at com.zimbra.cs.imap.ImapAuthenticatorUser.authenticate(ImapAuthenticatorUser.java:68)
at com.zimbra.cs.security.sasl.Authenticator.authenticate(Authenticator.java:189)
at com.zimbra.cs.security.sasl.PlainAuthenticator.handle(PlainAuthenticator.java:81)
at com.zimbra.cs.imap.ImapHandler.continueAuthentication(ImapHandler.java:383)
at com.zimbra.cs.imap.ImapHandler.continueAuthentication(ImapHandler.java:374)
at com.zimbra.cs.imap.NioImapHandler.processRequest(NioImapHandler.java:120)
at com.zimbra.cs.imap.NioImapHandler.messageReceived(NioImapHandler.java:63)
at com.zimbra.cs.server.NioHandlerDispatcher.messageReceived(NioHandlerDispatcher.java:95)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:716)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:434)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:46)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:796)
at org.apache.mina.filter.codec.ProtocolCodecFilter$ProtocolDecoderOutputImpl.flush(ProtocolCodecFilter.java:427)
at org.apache.mina.filter.codec.ProtocolCodecFilter.messageReceived(ProtocolCodecFilter.java:245)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:434)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:46)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:796)
at com.zimbra.cs.server.NioLoggingFilter.messageReceived(NioLoggingFilter.java:68)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:434)
at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:46)
at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:796)
at org.apache.mina.core.filterchain.IoFilterEvent.fire(IoFilterEvent.java:75)
at org.apache.mina.core.session.IoEvent.run(IoEvent.java:63)
at org.apache.mina.filter.executor.OrderedThreadPoolExecutor$Worker.runTask(OrderedThreadPoolExecutor.java:780)
at org.apache.mina.filter.executor.OrderedThreadPoolExecutor$Worker.runTasks(OrderedThreadPoolExecutor.java:772)
at org.apache.mina.filter.executor.OrderedThreadPoolExecutor$Worker.run(OrderedThreadPoolExecutor.java:714)
at java.base/java.lang.Thread.run(Thread.java:834)

[dapa6]

Hello
observing the same behavior on 8.8.15P46 just for ios18 users with imap configured and apple mail client.

[hisfran]

I'm not sure if it is the exact same thing but also on a Ubuntu 16 LTS 8.8.15P46 Zimbra installation:
I have one user with 3 email accounts, one of them becomes inaccessible for a few hours every other day.
The other accounts work.

So far when I checked the account was not shown as status = locked in the Zimbra Admin Console.
I'm used to accounts getting locked out, but it is the first time I see this locking issue.

See below: any idea how to fix this?
Zimbra is not supporting 8.8.15 anymore, so I can get no help from Zimbra support.

Any idea welcome.

I can't find any login error for this account in the logs but found some of these:

Code: Select all

ua=Mac OS X Mail/16.0 (3818.100.11.1.3);cid=2139302;] mailbox - transaction canceled because of lock failure

and

Code: Select all

ERROR [ImapSSLServer-46] [ip=10.0.0.101;oip=XX.XX.XX.XX;via=10.0.0.101(nginx/1.20.0);ua=Zimbra/8.8.15
_GA_4652;cid=2122635;] mailbox - Failed to lock mailbox

Apple says: If you see a "transaction canceled because of lock failure" message in your macOS Mail app, it usually means your mailbox is currently locked on the server, preventing access due to potential security concerns like too many failed login attempts, suspicious activity, or server maintenance; essentially, you need to contact your email provider to unlock your account.

Further checking the mailbox.log shows this:

Code: Select all

2024-10-16 04:52:07,494 ERROR [ImapSSLServer-49] [name=user@domain;mid=546;ip=10.0.0.101;oip=XX.XX.XX.XX;via=10.0.0.101(nginx/1.20.0);ua=com.apple.email.
maild/3818.100.11.2.5;cid=2067447;] imap - com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
com.zimbra.cs.mailbox.MailboxLock$LockFailedException: timeout
        at com.zimbra.cs.mailbox.MailboxLock.lock(MailboxLock.java:211) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.mailbox.Mailbox.lock(Mailbox.java:10758) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.imap.ImapListener.updateAccessTime(ImapListener.java:821) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.imap.NioImapHandler.processRequest(NioImapHandler.java:110) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.imap.NioImapHandler.messageReceived(NioImapHandler.java:63) ~[zimbrastore.jar:8.8.15_GA_4652]
        at com.zimbra.cs.server.NioHandlerDispatcher.messageReceived(NioHandlerDispatcher.java:95) ~[zimbrastore.jar:8.8.15_GA_4652]
        at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:1015) ~[mina-core-2.1.6.jar:?]
        at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:650) ~[mina-core-2.1.6.jar:?]
        at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:49) ~[mina-core-2.1.6.jar:?]

[dapa6]

Same kind of error observed on 8.8.15P46, what I've noticed is this kind of slow queries on MariaDB just before the first "Failed to lock" error:

Code: Select all

2024-10-17 15:30:24,655 INFO  [ImapSSLServer-24] [name=uset@domain;mid=610;ip=192.168.xx.xx;oip=xx.xx.xx.xx;via=192.168.xx.xx(nginx/1.20.0);ua=com.apple.email.maild/3818.100.11.2.3;cid=29006;] sqltrace - Slow execution ([b]648415ms[/b]): SELECT mi.id, mi.index_id, mi.type FROM mboxgroup10.mail_item AS mi WHERE mi.mailbox_id = 610 AND ((((mi.type = 5 OR mi.type = 6 OR mi.type = 16)) AND (((mi.id >= 126236 AND mi.id <= 126237)) OR ((mi.id >= 126248 AND mi.id <= 126250)) OR ((mi.id >= 126255 AND mi.id <= 126257)) OR ((mi.id >= 126260 AND mi.id <= 126262)) OR ((mi.id >= 126264 AND mi.id <= 126267)) OR ((mi.id >= 126281 AND mi.id <= 126282)) OR ((mi.id >= 126286 AND mi.id <= 126289)) OR ((mi.id >= 126292 AND mi.id <= 126294)) OR ((mi.id >= 126297 AND mi.id <= 126299)) OR ((mi.id >= 126308 AND mi.id <= 126311)) OR ((mi.id >= 126321 AND mi.id <= 126328)) OR ((mi.id >= 126330 AND mi.id <= 126332)) OR ((mi.id >= 126334 AND mi.id <= 126336)) OR ((mi.id >= 126345 AND mi.id.... 

A mailboxd service restart is required to restore user access.

Moving this users to active sync seems to solve the issue.

[jered]

I believe the surge here is due to a change in Apple iOS 18 Mail, where unreasonable IMAP SEARCH requests are being generated. I've started a new thread: viewtopic.php?t=72998

[hisfran]

Hi Dapa6,

How did you "move this user to Active Sync" ?
Fran


Moving this users to active sync seems to solve the issue.
[/quote]

[jered]

How did you "move this user to Active Sync" ?
Fran

Mobile Push (Active Sync) is a Professional-edition feature. If you have this license, you can add Zimbra as a "Microsoft Exchange" account rather than an IMAP account. It's not really a valid workaround for most customers unless you have a few spare $100k-1m to deal with a bug.

[phoenix]

Hey everyone, this has been happening not that often but lets say every 3 or 4 months. Randomly a user mailbox gets "locked", user can access, emails stay on the queue with "Temporary mail delivery ... " When I check the logs on /opt/zimra/logs/mailbox.log the following shows up.

You really should always give your version of ZCS by posting the full output of the following:

Code: Select all

su - zimbra
zmcontrol -v