package logcheck-database
tags 327088 pending
thanks

On Thu, 2005-10-06 at 04:28 +0200, Morten 'Doc' Nielsen wrote:
> from what i can see, your new log format does not hide regular logins, 
> so now my logcheck email is full of lines like this:
> 
> Oct 5 20:02:03 docnielsen dovecot: imap-login: Login: user=<doc>, 
> method=PLAIN, rip=192.168.1.123, lip=192.168.1.123, TLS

I've added the following rule for the new log message format in dovecot
1.0:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dovecot: (imap|pop3)-login: Login:
user=<[.[:alnum:[EMAIL PROTECTED]>, method=(PLAIN|LOGIN|(CRAM|DIGEST)-MD5),
rip=(::ffff:)?[.[:digit:]]+, lip=(::ffff:)?[.[:digit:]]+(, TLS)?$

It'll be included in the next release.

Thanks,

-- 
-Jamie L. Penman-Smithson <[EMAIL PROTECTED]>
 t: +44 1273 424795; f: +44 1273 424795
 PGP: C0A7 955E EED6 A309 23D7 863B C76A 26A3 F0DC FCA8
 never send mail to: [EMAIL PROTECTED]

Attachment: signature.asc
Description: This is a digitally signed message part

Reply via email to