On 13.4.2012, at 17.32, Root Kev wrote: > 643 dovecot 20 0 3096 1616 1208 S 50.7 0.2 0:01.76 > auth
Well, I can't think of any good reason for this. Try strace -p 643 (or whatever pid of the process eating CPU) for a few seconds and send its output? Also maybe get a couple of gdb backtraces to see where it's doing stuff: gdb -p 643 bt quit and repeat it a few times
