Re: split auth from other logging

2018-10-01 Thread Michael Slusarz
For later versions of 2.3.x, it will eventually be possible to use log filtering to accomplish this entirely within Dovecot. We are not quite there yet though. michael > On September 26, 2018 at 1:21 AM Kai Schaetzl wrote: > > > Is there a way to split the auth logging (logins and failed l

Re: split auth from other logging

2018-09-26 Thread Admin
This is great, thank you!! -M > Am 26.09.2018 um 15:53 schrieb Kai Schaetzl : > > This works for splitting off lmtp traffic, for instance. > > syslog_facility = uucp > > rsyslog: > > :msg, contains, "lmtp(" -/var/log/dovecot/lmtp.log > & stop > > uucp.=debug -/var/log/dov

Re: split auth from other logging

2018-09-26 Thread Kai Schaetzl
I forgot to mention that you have to change owner for the /var/log/dovecot directory before rsyslog can log. Kai

Re: split auth from other logging

2018-09-26 Thread Kai Schaetzl
This works for splitting off lmtp traffic, for instance. syslog_facility = uucp rsyslog: :msg, contains, "lmtp(" -/var/log/dovecot/lmtp.log & stop uucp.=debug -/var/log/dovecot/debug.log uucp.=info -/var/log/dovecot/dovecot.log uucp.=warn

Re: split auth from other logging

2018-09-26 Thread Kai Schaetzl
I'm not going to log dovecot to mail, that creates only the same mixup as before, even worse, now postfix and dovecot mixed. I had to stop/start (force-reload would also work) rsyslogd to pick up the changed config. A restart doesn't change the config as with other daemons. Now I can filter lmt

Re: split auth from other logging

2018-09-26 Thread Kai Schaetzl
Kai Schaetzl wrote on Wed, 26 Sep 2018 12:43:28 +0200: > But it logs only to /var/log/syslog It seems that "service rsyslog restart" doesn't correctly restart rsyslogd. You have to stop and start it. Then it picks up the changed config. Kai -- Get your web at Conactive Internet Services: htt

Re: split auth from other logging

2018-09-26 Thread ad...@awib.it
# Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err/var/log/mail.err > Am 26.09.2018 um 12:43 schrieb Kai S

Re: split auth from other logging

2018-09-26 Thread Kai Schaetzl
I hoped I don't have to switch to syslog logging. Well, anyway. I changed 10-logging.conf: syslog_facility = uucp and commented out the other log lines. rsyslog.d/50-default.conf: uucp.debug -/var/log/dovecot/debug.log uucp.info -/var/log/dovecot/doveco

Re: split auth from other logging

2018-09-26 Thread ad...@awib.it
Hi, yesterday I had something similar. I would like to skip the login & logout lines from being logged. This is something I found, but did not get it working, as I had no time fiddling with the rsyslog config yet: https://serverfault.com/questions/253418/force-dovecot-not-to-log-connect-disconn

split auth from other logging

2018-09-26 Thread Kai Schaetzl
Is there a way to split the auth logging (logins and failed logins) from the other logging that goes to info_log_path = /var/log/dovecot/dovecot.log ? This log gets a lot of other info as well, most notably the lmtp notifications about every filed mail (with no level stamping, btw). This makes i