package logcheck-database tags 327088 pending thanks On Thu, 2005-10-06 at 04:28 +0200, Morten 'Doc' Nielsen wrote: > from what i can see, your new log format does not hide regular logins, > so now my logcheck email is full of lines like this: > > Oct 5 20:02:03 docnielsen dovecot: imap-login: Login: user=<doc>, > method=PLAIN, rip=192.168.1.123, lip=192.168.1.123, TLS
I've added the following rule for the new log message format in dovecot 1.0: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dovecot: (imap|pop3)-login: Login: user=<[.[:alnum:[EMAIL PROTECTED]>, method=(PLAIN|LOGIN|(CRAM|DIGEST)-MD5), rip=(::ffff:)?[.[:digit:]]+, lip=(::ffff:)?[.[:digit:]]+(, TLS)?$ It'll be included in the next release. Thanks, -- -Jamie L. Penman-Smithson <[EMAIL PROTECTED]> t: +44 1273 424795; f: +44 1273 424795 PGP: C0A7 955E EED6 A309 23D7 863B C76A 26A3 F0DC FCA8 never send mail to: [EMAIL PROTECTED]
signature.asc
Description: This is a digitally signed message part