SF.net SVN: logwatch:[101] scripts/services/dovecot

Revision: 101
          http://logwatch.svn.sourceforge.net/logwatch/?rev=101&view=rev
Author:   opoplawski
Date:     2012-04-25 16:57:46 +0000 (Wed, 25 Apr 2012)
Log Message:
-----------
Handle dovecot proxy messages

Modified Paths:
--------------
    scripts/services/dovecot

Modified: scripts/services/dovecot
===================================================================
--- scripts/services/dovecot	2012-04-17 15:32:55 UTC (rev 100)
+++ scripts/services/dovecot	2012-04-25 16:57:46 UTC (rev 101)
@@ -198,6 +198,24 @@
          $Connection{$Host}++;
        }
 
+   # Dovecot 2.0 proxy
+   } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag pop3-login: proxy\((.*)\): started proxying to .*: user=<.*>, method=.*, rip=(.*), lip=/ ) ) {
+      if ($Host !~ /$IgnoreHost/) {
+         $ProxyLogin{$User}{$Host}++;
+         $ProxyLoginPOP3{$User}++;
+         $ProxyConnectionPOP3{$Host}++;
+         $ProxyConnection{$Host}++;
+      }
+   } elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag imap-login: proxy\((.*)\): started proxying to .*: user=<.*>, method=.*, rip=(.*), lip=/ ) ) {
+      if ($Host !~ /$IgnoreHost/) {
+         $ProxyLogin{$User}{$Host}++;
+         $ProxyLoginIMAP{$User}++;
+         $ProxyConnectionIMAP{$Host}++;
+         $ProxyConnection{$Host}++;
+      }
+   } elsif ( ($Reason) = ( $ThisLine =~ /proxy\(.*\): disconnecting .* \(Disconnected (.*)\)/ ) ) {
+      $ProxyDisconnected{$Reason}++;
+
    } elsif ($ThisLine =~ /Disconnected (\[|top)/) {
       $Disconnected{"no reason"}++;
    } elsif (($Reason) = ($ThisLine =~ /Disconnected: (.*) \[/) ) {
@@ -485,6 +503,49 @@
    }
 }
 
+if ( ( $Detail >= 5 ) and (keys %ProxyLogin)) {
+   print "\n\nDovecot Proxy IMAP and POP3 Successful Logins:";
+   $LoginCount = 0;
+   foreach my $User (sort keys %ProxyLogin) {
+      print "\n  User $User:";
+      if ( ($Detail >= 10) and ($ProxyLoginPOP3{$User} > 0 || $ProxyLoginIMAP{$User} > 0) ) {
+         print "   (";
+         if ($ProxyLoginPOP3{$User} > 0) { print "$ProxyLoginPOP3{$User} POP3"; };
+         if ($ProxyLoginPOP3{$User} > 0 && $ProxyLoginIMAP{$User} > 0) { print "/"; };
+         if ($ProxyLoginIMAP{$User} > 0) { print "$ProxyLoginIMAP{$User} IMAP"; };
+         print ")";
+      }
+      $UserCount = 0;
+      $NumHosts = 0;
+      foreach $Host (sort keys %{$ProxyLogin{$User}}) {
+         $NumHosts++;
+         $HostCount = $ProxyLogin{$User}{$Host};
+# Cleanly display IPv4 addresses
+         $Host=~ s/::ffff://;
+         print "\n    From $Host: $HostCount Time(s)" if ($Detail >= 10);
+         $UserCount += $HostCount;
+      }
+      $LoginCount += $UserCount;
+      if ($Detail >= 10) {
+         if ($NumHosts > 1) {
+            print "\n  Total: $UserCount Time(s)\n";
+         } else {
+	    print "\n";
+	 }
+      } elsif ($Detail >= 5) {
+         print " $UserCount Time(s)";
+      }
+   }
+   print "\nTotal: $LoginCount successful logins";
+}
+
+if (keys %ProxyDisconnected) {
+   print "\n\nDovecot Proxy disconnects:\n";
+   foreach my $Reason (sort keys %ProxyDisconnected) {
+      print "   $Reason: $ProxyDisconnected{$Reason} Time(s)\n";
+   }
+}
+
 if (keys %OtherList) {
    print "\n\n**Unmatched Entries**\n";
    foreach $line (sort {$a cmp $b} keys %OtherList) {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/