Multiple activesync accounts on 1 device: many pings, and foldersyncs, normal?

pwhooftman

I have been troubleshooting high cpu usage of gromox-http since upgrading 2 week ago. I have it narrowed down to accounts in Mobile Outlook on a Oneplus 13 Android phone which produced many many '401' errors in grommunio-sync.log, though nothing changed in the credentials. I deleted those accounts for now.

In the proces i also deleted all accounts on my iPad, and have recreated those three accounst after i discovered the iPad was not the fault (email sync only, no calendar, tasks, etc). Theo 3 accounts sync correctly, but i notice that there are many connections visible in Mobile devices and grommunio-sync.log gets swamped with 'ping' and 'foldersync' commands every second for the various accounts. Altough these commands all give a status code 200 (succesfull) back, it seems the 3 account syncs are fighting eachother and creating unneccesary foldersyncs. Chatgpt tells me it's not right those 3 accounts all get the same devide ID in Grommunio, which is the problem of the many pings and foldersyncs. Is this normal behaviour?

Edit: i temporarely disabled two of three newly created accounts to let 1 account per time catch up, and that has calmed things down to the point where alle 3 accounts are now active without ping an foldersync floods. But it makes me wonder, could there have been a situation where (also) 3 accounts on the android phone whre constantly fighting eachother, never completing a single account sync?

Edit2: after 15 minutes, the ping & foldersync storm came back: currently 35 connections to the one device going on for half an hour while using the ipad (not using the mail program), with accompanied gromox-http cpu spikes.

pwhooftman

There is a serious bug in Grommunio-sync when multiple email accounts are defined in Outlook Mobile on a Android Oneplus 13.

If i create 3 accounts in Mobile Outlook to sync to my server (5 users community edition, Suse 15.6 up to date). Those email accounts sync correctly when added one after another. But then first, a kind of ping-foldersync flood arises like in the screenshot above. And then, after some time, the /var/log/grommunio-sync/grommunio-sync-error.log gets flooded with authentication errors, but none of the credentials were changed in the mean time! If i delete the accounts in Mobile Outlook , the storm lays down after half an hour or so and grommunio-sync and gromox-api start working normally. I do not have these problems with the email program on an ipad, and with Nine email in my OnbePlus 9.

09/12/2025 09:50:43 [ 4818] [ERROR] [info@hooftman.net] HandleSync(): error saving '{847af622-31c7-43be-b2d5-abc94b1fdc34}640' - no state information available 09/12/2025 15:34:52 [ 6916] [ WARN] [info@hooftman-consultancy.nl] SyncObject->Check(): object from type SyncMail: parameter 'from' contains an invalid email address '"Pieter Hooftman HC" </O=I63A835A7/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=0200000004000000-INFO>'. Address is removed. 09/12/2025 18:47:31 [ 4818] [ WARN] [info@hooftman-consultancy.nl] /usr/share/grommunio-sync/lib/utils/utils.php:579 iconv(): Detected an illegal character in input string (8) 09/12/2025 18:52:47 [ 4387] [ WARN] [info@hooftman-consultancy.nl] SyncObject->Check(): object from type SyncMail: parameter 'from' contains an invalid email address '"Pieter Hooftman HC" </O=I63A835A7/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=0200000004000000-INFO>'. Address is removed. 09/12/2025 19:16:13 [ 6916] [ WARN] [info@hooftman-consultancy.nl] /usr/share/grommunio-sync/lib/utils/utils.php:579 iconv(): Detected an illegal character in input string (8) 09/12/2025 19:21:15 [19381] [ WARN] [info@hooftman-consultancy.nl] SyncObject->Check(): object from type SyncMail: parameter 'to' contains an invalid email address '"Undisclosed recipients" <>'. Address is removed. 09/12/2025 20:17:31 [ 6211] [FATAL] [#unknown] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:36 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:38 [ 6211] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:39 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:40 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:41 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:45 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:45 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:46 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:46 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:46 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:47 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:47 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:47 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:47 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:48 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:48 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:49 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:49 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:49 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:50 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:50 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:51 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:51 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:52 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:52 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:53 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:53 [27863] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information 09/12/2025 20:18:53 [ 2879] [FATAL] [#myemail@mydomain.nl] Exception: (AuthenticationRequiredException) - Access denied. Please send authorisation information
Aboutthe same time, admin-api starts trowing errors:
[2025-12-09 21:17:32.971042]: [ERROR] (grommunio Admin API) Response validation failed: [InvalidSchemaValue(value={'data': [{'addinfo': 'OK : AuthenticationRequiredException', 'asversion': False, 'command': False, 'devagent': 'unknown', 'devid': 'none', 'devtype': False, 'ended': 1765311451, 'ip': '10.0.0.80', 'pid': 6211, 'push': False, 'start': 1765311451, 'update': 1765311451, 'user': False}, {'addinfo': 'Sink 120/900s on Email', 'asversion': '16.1', 'command': 18, 'devagent': 'Apple-iPad13C2/2302.85', 'devid': '5ci3j5o5n55mj2i8211r0sp0a8', 'devtype': 'iPad', 'ended': 0, 'ip': '10.0.0.80', 'pid': 19381, 'push': True, 'start': 1765311307, 'update': 1765311428, 'user': 'myemail@mydomain.nl'}]}, type=<SchemaType.OBJECT: 'object'>, schema_errors=(<ValidationError: 'False is not of type string'>, <ValidationError: 'False is not of type string'>, <ValidationError: 'False is not of type integer'>, <ValidationError: 'False is not valid under any of the given schemas'>))] [2025-12-09 21:17:32.971741]: [WARNING] (grommunio Admin API) GET /api/v1/system/sync/top?filterEnded=20&filterUpdated=120 from 10.0.0.213 -> 500 '{"message":"The server generated an invalid response."}\n' [2025-12-09 21:17:34.974043]: [ERROR] (grommunio Admin API) Response validation failed: [InvalidSchemaValue(value={'data': [{'addinfo': 'OK : AuthenticationRequiredException', 'asversion': False, 'command': False, 'devagent': 'unknown', 'devid': 'none', 'devtype': False, 'ended': 1765311451, 'ip': '10.0.0.80', 'pid': 6211, 'push': False, 'start': 1765311451, 'update': 1765311451, 'user': False}, {'addinfo': 'Sink 120/900s on Email', 'asversion': '16.1', 'command': 18, 'devagent': 'Apple-iPad13C2/2302.85', 'devid': '5ci3j5o5n55mj2i8211r0sp0a8', 'devtype': 'iPad', 'ended': 0, 'ip': '10.0.0.80', 'pid': 19381, 'push': True, 'start': 1765311307, 'update': 1765311428, 'user': 'myemail@mydomain.nl'}]}, type=<SchemaType.OBJECT: 'object'>, schema_errors=(<ValidationError: 'False is not of type string'>, <ValidationError: 'False is not of type string'>, <ValidationError: 'False is not of type integer'>, <ValidationError: 'False is not valid under any of the given schemas'>))] [2025-12-09 21:17:34.975162]: [WARNING] (grommunio Admin API) GET /api/v1/system/sync/top?filterEnded=20&filterUpdated=120 from 10.0.0.213 -> 500 '{"message":"The server generated an invalid response."}\n' [2025-12-09 21:17:36.972929]: [ERROR] (grommunio Admin API) Response validation failed: [InvalidSchemaValue(value={'data': [{'addinfo': 'OK : AuthenticationRequiredException', 'asversion': False, 'command': False, 'devagent': 'unknown', 'devid': 'none', 'devtype': False, 'ended': 1765311451, 'ip': '10.0.0.80', 'pid': 6211, 'push': False, 'start': 1765311451, 'update': 1765311451, 'user': False}, {'addinfo': 'Sink 120/900s on Email', 'asversion': '16.1', 'command': 18, 'devagent': 'Apple-iPad13C2/2302.85', 'devid': '5ci3j5o5n55mj2i8211r0sp0a8', 'devtype': 'iPad', 'ended': 0, 'ip': '10.0.0.80', 'pid': 19381, 'push': True, 'start': 1765311307, 'update': 1765311428, 'user': 'myemail@mydomain.nl'}]}, type=<SchemaType.OBJECT: 'object'>, schema_errors=(<ValidationError: 'False is not of type string'>, <ValidationError: 'False is not of type string'>, <ValidationError: 'False is not of type integer'>, <ValidationError: 'False is not valid under any of the given schemas'>))]

I have none of these issues when syncing multiple accounts from 'Nine email' from my Android phone, and i never had issues prior to upgrading a few weeks ago.

crpb

pwhooftman Outlook Mobile

are you talking about microsoft outlook on android?

i recommend you remove all accounts inside the app and then uninstall and never look at it again.

it saves your credentials in the cloud and will try to synchronize the account even if your phone isn't on or you uninstalled the app w/o removing the accounts from it.

EDIT: and i would change the passwords of any accounts which were used in the app

pwhooftman

crpb Yes i am talking about microsoft outlook on android.

But these problems started when i updated Grommunio a few weeks ago after not updating for like a year. And yesterday evening the same problems started with my Nine Email client on my android phone. There is something going on i can't explain and am still investigating.

crpb

pwhooftman

Does GMAIL (the internal/shipped one) work?
Maybe ninemail has some nice gimmicks i never tried but i would definitely test against google-mail which you already get anyway in "almost" all cases i guess.

And there are things you might wanna try,

Remove the Account('s) from the (android) devices
Remove/Delete(NOT! ~~wipe~~) the Devices via grommunio-web(settings) or admin-web(user->devices)
Either wait a bit ... 15-30 minutes or restart php-fpm and redis (this isn't really necessary but could speed things up)
Add the account('s) again.

i think i forgot something but someone will probably remind us 😛

And just for good measure post your installed versions

pwhooftman

I had a hard time believing crpb in telling that microsoft outlook would take my credentials and store them in the cloud, even if that are credentials pointing to my own Grommunio server.
But by analyzing my Nginx Reverse Proxy logs i was able to determine that i got about 1 million hits in the last ten days from a Microsoft ip-adress in Paris with activesync accounts which i deleted from my wifes phone in microsoft outlook. Appearently the microsoft cloud indeed keeps trying to sync (or remove the sync profiles but fails to do so), hammering my Grommunio server with 100.000 requests a day! I have been able to block the resquests in my Nginx Reverse Proxy server by putting this in the custom configuration:
if ($args ~* "DeviceId=6f0122a8c67d43fdc8214056f87d1e021") {
return 403;
}

So, solved!
I obviously won't re-enter those accounts in Outlook Mobile but will put Nine email on my wifes phone also.

I also learned that having many connections open in the Mobile devices pages in itself isn't a problem, but it isn't normal if they all show time 00:00 or not much more. Connections should stick 10 seconds or more.

BTW, i use Outlook Classic on my laptop, that doesn't show this behaviour, Microsoft Outlook on the Android mobile was the culprint.

crpb

fwiw, on one server i added those rules as the host has a public ip and i didn't wanna wait anymore for some people to fix it on their end.

# firewall-cmd --zone=public --list-all
...
  rich rules:
        rule family="ipv4" source address="40.120.0.0/14" reject
        rule family="ipv4" source address="40.112.0.0/13" reject
        rule family="ipv4" source address="52.125.0.0/16" reject
        rule family="ipv4" source address="40.124.0.0/16" reject
        rule family="ipv4" source address="40.80.0.0/12" reject
        rule family="ipv4" source address="40.125.0.0/17" reject
        rule family="ipv4" source address="40.76.0.0/14" reject
        rule family="ipv4" source address="52.112.0.0/14" reject
        rule family="ipv4" source address="52.126.0.0/15" reject
        rule family="ipv4" source address="40.74.0.0/15" reject
        rule family="ipv4" source address="40.96.0.0/12" reject
        rule family="ipv4" source address="52.96.0.0/12" reject

apt install -y asn
( for asn in  52.126.0.0/15 52.125.0.0/16 52.96.0.0/12 52.112.0.0/14 40.120.0.0/14 40.112.0.0/13 40.76.0.0/14 40.74.0.0/15 40.96.0.0/12 40.124.0.0/16 40.80.0.0/12 40.125.0.0/17; do asn -j $asn; done )  | jq --slurp '.[]|.results[]|.org_name'

for cidr in 52.126.0.0/15 52.125.0.0/16 52.96.0.0/12 52.112.0.0/14 40.120.0.0/14 40.112.0.0/13 40.76.0.0/14 40.74.0.0/15 40.96.0.0/12 40.124.0.0/16 40.80.0.0/12 40.125.0.0/17; do firewall-cmd --permanent --zone=public --add-rich-rule="rule family='ipv4' source address='"$cidr"' reject" ; done

pwhooftman

FYI, i got hit by these ip addresses:

Hits Visitors Tx. Amount City Country ASN Data

1 794.237 (61.07%) 8 (01.02%) 5.2 GiB (16.47%) Paris, Île-de-France FR France 08075: MICROSOFT-CORP-MSN-AS-BLOCK 40.104.65.53
2 195.984 (15.07%) 3 (00.38%) 1 GiB (03.18%) Amsterdam, North Holland NL The Netherlands 08075: MICROSOFT-CORP-MSN-AS-BLOCK 40.99.158.101