Fwd: improvement for dovecot log parsing

---------- Forwarded message ----------
From: Kees Cook <[email protected]>
Date: Fri, 23 Jan 2009 12:11:22 -0800
Subject: improvement for dovecot log parsing
To: [email protected]

--- scripts/services/dovecot.orig	2009-01-23 12:09:39.000000000 -0800
+++ scripts/services/dovecot	2009-01-23 12:09:52.000000000 -0800
@@ -133,21 +133,28 @@

 # This is for Dovecot 1.0 series

-   } elsif ($ThisLine =~ /Disconnected for inactivity/) {
-      $Disconnected{"Inactivity"}++;
-   } elsif ($ThisLine =~ /Disconnected in IDLE/) {
-      $Disconnected{"in IDLE"}++;
-   } elsif ($ThisLine =~ /Disconnected$/) {
-      $Disconnected{"no reason"}++;
-   } elsif (($Reason) = ($ThisLine =~ /pop3-login: Disconnected: (.+)/) ) {
-      $Disconnected{"no reason"}++;
-   } elsif (($Reason) = ($ThisLine =~ /imap-login: Disconnected: (.+)/) ) {
-      $Disconnected{"no reason"}++;
-   } elsif (($Reason) = ($ThisLine =~ /IMAP.+: Disconnected: (.+)/) ) {
-      $Disconnected{$Reason}++;
-   } elsif (($Reason) = ($ThisLine =~ /POP3.+: Disconnected: (.+) top/) ) {
-      $Disconnected{$Reason}++;
-
+   } elsif ($ThisLine =~ /(Disconnected|Connection closed):?\s*(.*)/) {
+      $How = $1;
+      $Reason = $2;
+      if ($Reason =~ /for inactivity/) {
+         $Disconnected{"Inactivity"}++;
+      }
+      elsif ($Reason =~ /in IDLE/) {
+         $Disconnected{"in IDLE"}++;
+      }
+      elsif ($How eq "Connection closed") {
+         $Disconnected{"Closed"}++;
+      }
+      else {
+         # Drop "word=num/num," sets (bytes=64/340, top=0/0, retr=0/0, etc)
+         $Reason =~ s/\s*(\w+=\d+(\/\d+)?(, |$))+//;
+         if ($Reason eq "") {
+            $Disconnected{"no reason"}++;
+         }
+         else {
+            $Disconnected{$Reason}++;
+         }
+      }
    } else {
       # Report any unmatched entries...
       chomp($ThisLine);

-- 
Kees Cook                                            @outflux.net


-- 
Sent from my mobile device


------------------------------------------------------
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration