Running an email server can result in some strange problems at times – a common one being the /var/spool/mqueue filling up (which I really need to write an article on….), and one which can be hard to pin down: A POP3 user with a mailbox that is too big.

I recently ran into a scenario where a user’s mailbox (which REALLY should have had a quota, but didn’t) had grown quite large (~1GB). When the user went to check their mail, the following would happen:

1. Mail client (Thunderbird, in this case), connects to the mail server and sends username and password
2. When the user is authenticated (right after the client sends the “PASS xxxxx” command), the pop3d process makes a copy of the user’s mailbox in the temporary directory (/tmp in my case)
3. There was insufficient space for the copy of the user’s mailbox in the temporary directory, and when if ills up the server aborts the operation sending an error like “-ERR cannot open mailbox /home/userdir/.mail/mbox: No space left on device”
4. The pop3d process clears out the temporary file (something like /tmp/pop3oj5oyy) freeing up the space
5. Email client (hopefully) shows the end user a meaningful error

The real problem with this process is the momentary filling up of the temporary directory which can cause a problem for virtually any other process (in my case it was frequently showing up as database errors on websites, amongst other odd problems)

In this case, I found I had a user’s mailbox file that was about 1.2GB:
ls -sh /home/userdir/.mail/mbox
1.2G mbox

To check how many messages there are in it run:
grep -c "^From\ " mbox
15881

15000+ messages!

Now to the fixing it part:

First move to another location so that nothing is added to it while working with it (preferably after shutting down your MTA, ie: /etc/init.d/sendmail stop – depending on your situation, this may not be practical) and switch to the directory where it is:
mv /home/userdir/.mail/mbox ~/mbox.tmp && cd ~
In my case, I figure if I break it into 10 chunks (about 1500 messages each) it should work fine:

cat mbox.tmp | formail -1500 -s > mbox.1

This gave me a file about 115MB.
If you shut down your MTA, just copy/move that file to the location where the original mailbox file was, fire up the MTA, and download the mail. If you did not shut down the MTA, you should append this new file to the mailbox that may be there now (if there was any new mail received). Note: This may be slightly dangerous, so making a backup copy of the mailbox file that is in place is highly recommended):

cat mbox.1 >> /home/userdir/.mail/mbox
Then, as above, download the mail.

Second chunk:
cat mbox.tmp | formail +1500 -1500 -s >mbox.2
Move the mbox.2 file as per above, and download.

Rinse and repeat, if necessary:
cat mbox.tmp | formail +3000 -1500 -s >mbox.2
Increasing the “+xxx value by the amount per download as required until it’s done.

Oh, and back to the title of this article: If we had a quota in place on this account, none of this would ever had happened!

Finding files by age is something that I find that I commonly do, for example:

find /etc -mtime +10 -maxdepth 1

Will find all files in /etc (maxdepth 1 sets it so that it won’t go into subdirectories) that are more than 10 days old

To find files in a date range, ie: more than 1 day old and less than 2:

find /etc/ -mtime 1 -mtime -2 -maxdepth 1