Dovecot is restarting about twice a day. Here is output generated by monit, which I grepped from syslog:
Jul 29 07:23:30 rjrwebserver1 monit[5419]: IMAP error: * OK Waiting for authentication process to respond..
Jul 29 07:23:30 rjrwebserver1 monit[5419]: 'dovecot' failed protocol test [IMAP] at INET[localhost:143] via TCP
Jul 29 07:23:30 rjrwebserver1 monit[5419]: 'dovecot' trying to restart
Jul 29 07:23:30 rjrwebserver1 monit[5419]: 'dovecot' stop: /etc/init.d/dovecot
Jul 29 07:23:31 rjrwebserver1 monit[5419]: 'dovecot' start: /etc/init.d/dovecot
Jul 29 07:23:31 rjrwebserver1 monit[5419]: 'dovecot' failed, cannot open a connection to INET[localhost:110] via TCP
Jul 29 07:23:32 rjrwebserver1 monit[5419]: 'dovecot' trying to restart
Jul 29 07:24:32 rjrwebserver1 monit[5419]: 'dovecot' connection passed to INET[localhost:143] via TCP
Jul 29 07:24:32 rjrwebserver1 monit[5419]: 'dovecot' connection passed to INET[localhost:110] via TCP
Looks like a problem with the authentication daemon? Is this hitting a resource limit somewhere?
Is it restarting around the same time each day?
If so, maybe something else is going on with the system at the time? For example, backups can be fairly resource intensive -- and that could cause Monit to think another service isn't responding.
One way to weed out false positives would be to have require it to fail multiple times before restarting... for example, using a line like this in your Monit config:
if failed port 143 protocol imap for 3 cycles then restart