Dnia 30.07.2021 o godz. 16:49:31 Hadmut Danisch pisze: > > Unfortunately, the required data, i.e. client IP address and username > are distributed in different log files. The IP address is written to > postfix's log, while the username is in saslauthd's log in case of > failure, with the time stamp as the only link between both.
Well, maybe I'm using quite old versions of Postfix and Dovecot, but with default logging setup on Debian plus "auth_verbose=yes" in Dovecot config I get in /var/log/mail.log lines like: Jul 30 23:15:17 rafa postfix/smtpd[23291]: warning: unknown[77.247.110.165]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jul 30 23:15:23 rafa dovecot: auth-worker(23296): pam(accou...@eu.org,77.247.110.165): pam_authenticate() failed: Authentication failure (password mismatch?) The second line has both things you need - IP address and username. -- Regards, Jaroslaw Rafa r...@rafa.eu.org -- "In a million years, when kids go to school, they're gonna know: once there was a Hushpuppy, and she lived with her daddy in the Bathtub."
