Re: Fwd: improvement for dovecot log parsing

Kirk Bauer wrote:
> ---------- Forwarded message ----------
> From: Kees Cook <[email protected]>
> Date: Fri, 23 Jan 2009 12:11:22 -0800
> Subject: improvement for dovecot log parsing
> To: [email protected]
> 
> --- scripts/services/dovecot.orig	2009-01-23 12:09:39.000000000 -0800
> +++ scripts/services/dovecot	2009-01-23 12:09:52.000000000 -0800
> @@ -133,21 +133,28 @@
> 
>  # This is for Dovecot 1.0 series
> 
> -   } elsif ($ThisLine =~ /Disconnected for inactivity/) {
> -      $Disconnected{"Inactivity"}++;
> -   } elsif ($ThisLine =~ /Disconnected in IDLE/) {
> -      $Disconnected{"in IDLE"}++;
> -   } elsif ($ThisLine =~ /Disconnected$/) {
> -      $Disconnected{"no reason"}++;
> -   } elsif (($Reason) = ($ThisLine =~ /pop3-login: Disconnected: (.+)/) ) {
> -      $Disconnected{"no reason"}++;
> -   } elsif (($Reason) = ($ThisLine =~ /imap-login: Disconnected: (.+)/) ) {
> -      $Disconnected{"no reason"}++;
> -   } elsif (($Reason) = ($ThisLine =~ /IMAP.+: Disconnected: (.+)/) ) {
> -      $Disconnected{$Reason}++;
> -   } elsif (($Reason) = ($ThisLine =~ /POP3.+: Disconnected: (.+) top/) ) {
> -      $Disconnected{$Reason}++;
> -
> +   } elsif ($ThisLine =~ /(Disconnected|Connection closed):?\s*(.*)/) {
> +      $How = $1;
> +      $Reason = $2;
> +      if ($Reason =~ /for inactivity/) {
> +         $Disconnected{"Inactivity"}++;
> +      }
> +      elsif ($Reason =~ /in IDLE/) {
> +         $Disconnected{"in IDLE"}++;
> +      }
> +      elsif ($How eq "Connection closed") {
> +         $Disconnected{"Closed"}++;
> +      }
> +      else {
> +         # Drop "word=num/num," sets (bytes=64/340, top=0/0, retr=0/0, etc)
> +         $Reason =~ s/\s*(\w+=\d+(\/\d+)?(, |$))+//;
> +         if ($Reason eq "") {
> +            $Disconnected{"no reason"}++;
> +         }
> +         else {
> +            $Disconnected{$Reason}++;
> +         }
> +      }
>     } else {
>        # Report any unmatched entries...
>        chomp($ThisLine);
> 


I think most of this is already in CVS because of the patch from

# Revision 1.12  2008/08/11 15:38:02  mike
# Connection closed patch from Niels Baggesen -mgt

Any dovecot users might want to verify this.

-Mike