Why does a cpanel user login to dovecot and exim every 5 minutes?

[skyrant]

Exim:

2020-02-13 20:43:00 SMTP connection from [127.0.0.1]:48180 (TCP/IP connection count = 1)
2020-02-13 20:43:00 SMTP connection from (localhost) [127.0.0.1]:48180 closed by QUIT
2020-02-13 20:48:02 SMTP connection from [127.0.0.1]:48208 (TCP/IP connection count = 1)
2020-02-13 20:48:02 SMTP connection from (localhost) [127.0.0.1]:48208 closed by QUIT
2020-02-13 20:53:04 SMTP connection from [127.0.0.1]:48236 (TCP/IP connection count = 1)
2020-02-13 20:53:04 SMTP connection from (localhost) [127.0.0.1]:48236 closed by QUIT
2020-02-13 20:58:05 SMTP connection from [127.0.0.1]:48264 (TCP/IP connection count = 1)
2020-02-13 20:58:05 SMTP connection from (localhost) [127.0.0.1]:48264 closed by QUIT
2020-02-13 21:05:02 SMTP connection from [127.0.0.1]:48294 (TCP/IP connection count = 1)
2020-02-13 21:05:02 SMTP connection from (localhost) [127.0.0.1]:48294 closed by QUIT
2020-02-13 21:10:04 SMTP connection from [127.0.0.1]:48322 (TCP/IP connection count = 1)
2020-02-13 21:10:04 SMTP connection from (localhost) [127.0.0.1]:48322 closed by QUIT
2020-02-13 21:15:05 SMTP connection from [127.0.0.1]:48350 (TCP/IP connection count = 1)
2020-02-13 21:15:05 SMTP connection from (localhost) [127.0.0.1]:48350 closed by QUIT
2020-02-13 21:20:07 SMTP connection from [127.0.0.1]:48378 (TCP/IP connection count = 1)
2020-02-13 21:20:07 SMTP connection from (localhost) [127.0.0.1]:48378 closed by QUIT
2020-02-13 21:25:09 SMTP connection from [127.0.0.1]:48406 (TCP/IP connection count = 1)
2020-02-13 21:25:09 SMTP connection from (localhost) [127.0.0.1]:48406 closed by QUIT
2020-02-13 21:30:10 SMTP connection from [127.0.0.1]:48434 (TCP/IP connection count = 1)
2020-02-13 21:30:10 SMTP connection from (localhost) [127.0.0.1]:48434 closed by QUIT
2020-02-13 21:35:12 SMTP connection from [127.0.0.1]:48462 (TCP/IP connection count = 1)
2020-02-13 21:35:12 SMTP connection from (localhost) [127.0.0.1]:48462 closed by QUIT

Dovecot

Feb 13 21:35:12 host dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<88OUBnuepLt/AAAB>
Feb 13 21:35:12 host dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<88OUBnuepLt/AAAB>
Feb 13 21:35:12 host dovecot: lmtp(8952): Connect from local
Feb 13 21:35:12 host dovecot: lmtp(8952): Connect from local
Feb 13 21:35:12 host dovecot: lmtp(8952): Disconnect from local: Client has quit the connection (state=READY)
Feb 13 21:35:12 host dovecot: lmtp(8952): Disconnect from local: Client has quit the connection (state=READY)
Feb 13 21:35:12 host dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__e_6cfmuh6hszqxr1>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=8965, secured, session=<mAWZBnuetul/AAAB>
Feb 13 21:35:12 host dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__e_6cfmuh6hszqxr1>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=8965, secured, session=<mAWZBnuetul/AAAB>
Feb 13 21:35:12 host dovecot: imap(__cpanel__service__auth__imap__e_6cfmuh6hszqxr1)<8965><mAWZBnuetul/AAAB>: Logged out in=11, out=490, bytes=11/490
Feb 13 21:35:12 host dovecot: imap(__cpanel__service__auth__imap__e_6cfmuh6hszqxr1)<8965><mAWZBnuetul/AAAB>: Logged out in=11, out=490, bytes=11/490

What is the purpose of this and if it is absolutely necessary, can i remove this from the logs?

 

[cPanelHB]

Hello,

The service monitoring system chkservd performs the logins every 5 minutes. We have some documentation regarding this here:

TailWatch | cPanel & WHM Documentation

The TailWatch driver monitors a log file for certain activities and then performs actions based on the activity.

docs.cpanel.net

Essentially it logs in periodically to make sure that Exim and Dovecot are working successfully.

You can disable the monitoring via the WHM » Service Manager interface, but I would strongly recommend against it. If Exim or Dovecot ever fail, chkservd will automatically start them back up when it cannot log in. However, if you disable the monitoring, it will remain down until you fix it yourself.

There is no way to remove it from the logs. I would suggest ignoring it.

Let us know if you have any further questions, issues, or concerns.

 

[skyrant]

Thanks. I take a look.