Am 14.08.2013 17:12, schrieb Reindl Harald: >> is it possible to get rid of the "proxy(t...@testserver.rhsoft.net): started >> proxying to 127.0.0.1:143: " part >> because on a proxy-only server i know that and it is explicitly not listed >> in "login_log_format_elements" >> > got it > > login_log_format_elements = user=<%u> method=%m rip=%r %k > login_log_format = %s
which introduces the problem that POP3 is double-logged i guess ":msg, contains, "): disconnecting" ~" in rsyslog.conf no longer takes effect Aug 14 22:54:37 mail dovecot: pop3-login: user=<u...@example.com>, method=PLAIN, rip=80.120.xx.xx Aug 14 22:54:37 mail dovecot: pop3-login: user=<u...@example.com>, method=PLAIN, rip=80.120.xx.xx given that "example.com" has 60 addresses which are checked by a exchange connector every 3 minutes you can calculate the logsize by 2400 loglines per hour which could be 1200 without disconnect log is there a option or would it not make sense in case "login_log_format = %s" skip the second line in default (non-debug) logging, most are gardly interested in how long a POP3 user took to receive his mails, the more interesting is how often, from which IPs and how much failed logins from where thanks!
signature.asc
Description: OpenPGP digital signature
