[PATCH] Dovecot format improvements
Richard Hansen <rhansen-A08e6c8yq/[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi all, Attached are some patches for Dovecot: 1. bug fix: Match Dovecot deliver lines when folders have spaces 2. enhancement: Simplify and improve Dovecot connection table format 3. enhancement: Improve formatting of the Dovecot deliver, login, and disconnect summaries 4. enhancement: Sort the connections, deliveries, logins, and disconnects by count 5. enhancement: Perform reverse DNS lookups on Dovecot remote IP addresses -Richard ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Logwatch-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/logwatch-devel
0001-Match-Dovecot-deliver-lines-when-folders-have-spaces.patch
(text/x-patch, 879 B)
Match Dovecot deliver lines when folders have spaces
Before, the Dovecot deliver regular expression did not match deliver
lines if the folder contained a space. Now it does.
diff --git a/scripts/services/dovecot b/scripts/services/dovecot
index 1792582..a74a045 100755
--- a/scripts/services/dovecot
+++ b/scripts/services/dovecot
@@ -151,7 +151,7 @@ while (defined($ThisLine = <STDIN>)) {
$Deliver{$User}{$Mailbox}++;
# For Sieve-based delivery
- } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda\(|deliver\(|lmtp\(\d+, )(.*)\): (?:[^:]+: )?sieve: msgid=.*: stored mail into mailbox '(\S+)'/ ) ) {
+ } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda\(|deliver\(|lmtp\(\d+, )(.*)\): (?:[^:]+: )?sieve: msgid=.*: stored mail into mailbox '([^']*)'/ ) ) {
$Deliver{$User}{$Mailbox}++;
# LMTP-based delivery
--
1.7.9.5
0002-Simplify-and-improve-Dovecot-connection-table-format.patch
(text/x-patch, 3.8 KB)
Simplify and improve Dovecot connection table format
* Move the counts to the left side of the host name so that long host
names do not disrupt the alignment
* Remove the vertical lines to reduce visual clutter
* Use narrower columns for the counts
* Simplify the code that formats the table
Before (detail 5+):
[Dovecot IMAP and POP3] Connections:
====================================
Host | POP3 | IMAP | Total
-------------------------------------- | --------- |--------- | ---------
203.0.113.133 | 0 | 40 | 40
203.0.113.153 | 0 | 13 | 13
203.0.113.19 | 0 | 24 | 24
198.51.100.248 | 0 | 4 | 4
192.0.2.143 | 0 | 5 | 5
192.0.2.115 | 0 | 1 | 1
172.23.45.67 | 0 | 41 | 41
-------------------------------------------------------------------------
0 | 128 | 128
After (detail 5+):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 40 40 203.0.113.133
0 13 13 203.0.113.153
0 24 24 203.0.113.19
0 4 4 198.51.100.248
0 5 5 192.0.2.143
0 1 1 192.0.2.115
0 41 41 172.23.45.67
------------------------------------------------------------------------
0 128 128 Total
diff --git a/scripts/services/dovecot b/scripts/services/dovecot
index a74a045..239f0c0 100755
--- a/scripts/services/dovecot
+++ b/scripts/services/dovecot
@@ -287,8 +287,8 @@ if ( ( $Detail >=5 ) and $Restarts ) {
if ( ( $Detail >= 5 ) and (keys %Connection)) {
print "\n[Dovecot IMAP and POP3] Connections:".
"\n====================================".
- "\n Host | POP3 | IMAP | Total ".
- "\n-------------------------------------- | --------- |--------- | ---------";
+ "\nPOP3 IMAP Total Host".
+ "\n" . "-" x 72;
$TLSInitFail = 0;
foreach $Host (sort keys %Connection) {
@@ -305,29 +305,13 @@ if ( ( $Detail >= 5 ) and (keys %Connection)) {
}
# Cleanly display IPv4 addresses
$Host=~ s/::ffff://;
- $HostLength = length($Host);
- $HostSpaceLength = 38 - $HostLength;
- $CountLength = length("$Conns");
- $CountSpaceLength = 10 - $CountLength;
- $IMAPLength = length("$IMAP");
- $IMAPSpaceLength = 9 - $IMAPLength;
- $TotalLength = length("$Total");
- $TotalSpaceLength = 10 - $TotalLength;
- print "\n" ." " x $HostSpaceLength . $Host . " |" . " " x $CountSpaceLength . $Conns .
- " |" . " " x $IMAPSpaceLength . $IMAP . " |" . " " x $TotalSpaceLength . $Total;
+ printf "\n%4s %4s %5s %s", $Conns, $IMAP, $Total, $Host;
$POP3Count += $Conns;
$IMAPCount += $IMAP;
$TotalCount += $Total;
}
- $POP3Length = length("$POP3Count");
- $POP3SpaceLength = 50 - $POP3Length;
- $IMAPLength = length("$IMAPCount");
- $IMAPSpaceLength = 9 - $IMAPLength;
- $TotalLength = length("$TotalCount");
- $totalSpaceLength = 10 - $TotalLength;
- print "\n" . "-" x 73;
- print "\n" . " " x $POP3SpaceLength . $POP3Count . " |" . " " x $IMAPSpaceLength . $IMAPCount .
- " |" . " " x $totalSpaceLength . $TotalCount . "\n";
+ print "\n" . "-" x 72;
+ printf "\n%4s %4s %5s %s", $POP3Count, $IMAPCount, $TotalCount, "Total";
}
if ( ( $Detail >= 5 ) and (keys %Deliver)) {
--
1.7.9.5
0003-Improve-formatting-of-the-Dovecot-deliver-login-and-.patch
(text/x-patch, 7.9 KB)
Improve formatting of the Dovecot deliver, login, and disconnect summaries
* Show a one-line total when detail=0
* Output fewer lines by putting the total on the same line as the
header
* Put the count to the left of the thing being counted to make it
easier to compare values
* Eliminate useless words to make it easier to quickly scan the
output
Before (detail 0-4):
Dovecot disconnects:
Disconnected in IDLE: 64 Time(s)
Inactivity: 33 Time(s)
Inactivity (no auth attempts): 4 Time(s)
Logged out: 16 Time(s)
no auth attempts: 48 Time(s)
After (detail 0-4):
Dovecot Deliveries: 107
Dovecot IMAP and POP3 Successful Logins: 128
Dovecot disconnects: 165
Before (detail 5-9):
Dovecot Deliveries:
User user1: 107 Time(s)
Total: 107 successful deliveries
Dovecot IMAP and POP3 Successful Logins:
User user1: 128 Time(s)
Total: 128 successful logins
Dovecot disconnects:
Disconnected in IDLE: 64 Time(s)
Inactivity: 33 Time(s)
Inactivity (no auth attempts): 4 Time(s)
Logged out: 16 Time(s)
no auth attempts: 48 Time(s)
After (detail 5-9):
Dovecot Deliveries: 107
107 user1
Dovecot IMAP and POP3 Successful Logins: 128
128 user1
Dovecot disconnects: 165
64 Disconnected in IDLE
33 Inactivity
4 Inactivity (no auth attempts)
16 Logged out
48 no auth attempts
Before (detail 10+):
Dovecot Deliveries:
User user1:
To INBOX: 12 Time(s)
To INBOX/bar/as df: 1 Time(s)
To INBOX/bar/jkl: 3 Time(s)
To INBOX/bar/qwe rty: 1 Time(s)
To INBOX/baz/sub/gexvb: 11 Time(s)
To INBOX/baz/sub/rtnxa: 4 Time(s)
To INBOX/baz/sub/sdnbtr: 5 Time(s)
To INBOX/foo/bif/aqefa: 1 Time(s)
To INBOX/foo/bif/poisbsdfsrew: 69 Time(s)
Total: 107 Time(s)
Total: 107 successful deliveries
Dovecot IMAP and POP3 Successful Logins:
User user1: (128 IMAP)
From 203.0.113.133: 40 Time(s)
From 203.0.113.153: 13 Time(s)
From 203.0.113.19: 24 Time(s)
From 198.51.100.248: 4 Time(s)
From 192.0.2.143: 5 Time(s)
From 192.0.2.115: 1 Time(s)
From 172.23.45.67: 41 Time(s)
Total: 128 Time(s)
Total: 128 successful logins
Dovecot disconnects:
Disconnected in IDLE: 64 Time(s)
Inactivity: 33 Time(s)
Inactivity (no auth attempts): 4 Time(s)
Logged out: 16 Time(s)
no auth attempts: 48 Time(s)
After (detail 10+):
Dovecot Deliveries: 107
107 user1
12 INBOX
1 INBOX/bar/as df
3 INBOX/bar/jkl
1 INBOX/bar/qwe rty
11 INBOX/baz/sub/gexvb
4 INBOX/baz/sub/rtnxa
5 INBOX/baz/sub/sdnbtr
1 INBOX/foo/bif/aqefa
69 INBOX/foo/bif/poisbsdfsrew
Dovecot IMAP and POP3 Successful Logins: 128
128 user1 (0 POP3, 128 IMAP)
40 203.0.113.133
13 203.0.113.153
24 203.0.113.19
4 198.51.100.248
5 192.0.2.143
1 192.0.2.115
41 172.23.45.67
Dovecot disconnects: 165
64 Disconnected in IDLE
33 Inactivity
4 Inactivity (no auth attempts)
16 Logged out
48 no auth attempts
diff --git a/scripts/services/dovecot b/scripts/services/dovecot
index 239f0c0..3428124 100755
--- a/scripts/services/dovecot
+++ b/scripts/services/dovecot
@@ -314,31 +314,27 @@ if ( ( $Detail >= 5 ) and (keys %Connection)) {
printf "\n%4s %4s %5s %s", $POP3Count, $IMAPCount, $TotalCount, "Total";
}
-if ( ( $Detail >= 5 ) and (keys %Deliver)) {
- print "\n\nDovecot Deliveries:";
- $DeliverCount = 0;
- foreach my $User (sort keys %Deliver) {
- print "\n User $User:";
- $UserCount = 0;
- $NumMailboxes = 0;
- foreach $Mailbox (sort keys %{$Deliver{$User}}) {
- $NumMailboxes++;
- $MailboxCount = $Deliver{$User}{$Mailbox};
- print "\n To $Mailbox: $MailboxCount Time(s)" if ($Detail >= 10);
- $UserCount += $MailboxCount;
+if (keys %Deliver) {
+ my $DeliverCount = 0;
+ my $DeliverUserCount = {};
+ foreach my $User (keys %Deliver) {
+ foreach my $Mailbox (keys %{$Deliver{$User}}) {
+ $DeliverUserCount{$User} += $Deliver{$User}{$Mailbox};
}
- $DeliverCount += $UserCount;
- if ($Detail >= 10) {
- if ($NumMailboxes > 1) {
- print "\n Total: $UserCount Time(s)\n";
- } else {
- print "\n";
- }
- } elsif ($Detail >= 5) {
- print " $UserCount Time(s)";
+ $DeliverCount += $DeliverUserCount{$User};
+ }
+ printf "\n" if ($Detail >= 5);
+ printf "\nDovecot Deliveries: %s", $DeliverCount;
+ if ($Detail >= 5) {
+ foreach my $User (sort keys %DeliverUserCount) {
+ printf "\n %4s %s", $DeliverUserCount{$User}, $User;
+ if ($Detail >= 10) {
+ foreach my $Mailbox (sort keys %{$Deliver{$User}}) {
+ printf "\n %4s %s", $Deliver{$User}{$Mailbox}, $Mailbox;
+ }
+ }
}
}
- print "\nTotal: $DeliverCount successful deliveries";
}
if (($Detail >= 10) and (keys %Forwarded)) {
@@ -382,40 +378,33 @@ if (($Detail >= 10) and (keys %VacationDup)) {
}
-if ( ( $Detail >= 5 ) and (keys %Login)) {
- print "\n\nDovecot IMAP and POP3 Successful Logins:";
- $LoginCount = 0;
- foreach my $User (sort keys %Login) {
- print "\n User $User:";
- if ( ($Detail >= 10) and ($LoginPOP3{$User} > 0 || $LoginIMAP{$User} > 0) ) {
- print " (";
- if ($LoginPOP3{$User} > 0) { print "$LoginPOP3{$User} POP3"; };
- if ($LoginPOP3{$User} > 0 && $LoginIMAP{$User} > 0) { print "/"; };
- if ($LoginIMAP{$User} > 0) { print "$LoginIMAP{$User} IMAP"; };
- print ")";
+if (keys %Login) {
+ my $LoginCount = 0;
+ my $LoginUserCount = {};
+ foreach my $User (keys %Login) {
+ foreach my $Host (keys %{$Login{$User}}) {
+ $LoginUserCount{$User} += $Login{$User}{$Host};
}
- $UserCount = 0;
- $NumHosts = 0;
- foreach $Host (sort keys %{$Login{$User}}) {
- $NumHosts++;
- $HostCount = $Login{$User}{$Host};
-# Cleanly display IPv4 addresses
- $Host=~ s/::ffff://;
- print "\n From $Host: $HostCount Time(s)" if ($Detail >= 10);
- $UserCount += $HostCount;
- }
- $LoginCount += $UserCount;
- if ($Detail >= 10) {
- if ($NumHosts > 1) {
- print "\n Total: $UserCount Time(s)\n";
- } else {
- print "\n";
- }
- } elsif ($Detail >= 5) {
- print " $UserCount Time(s)";
+ $LoginCount += $LoginUserCount{$User};
+ $LoginPOP3{$User} = 0 if $LoginPOP3{$User} <= 0;
+ $LoginIMAP{$User} = 0 if $LoginIMAP{$User} <= 0;
+ }
+ printf "\n" if ($Detail >= 5);
+ printf "\nDovecot IMAP and POP3 Successful Logins: %s", $LoginCount;
+ if ($Detail >= 5) {
+ foreach my $User (sort keys %LoginUserCount) {
+ printf("\n %4s %s", $LoginUserCount{$User}, $User);
+ if ($Detail >= 10) {
+ printf(" (%s POP3, %s IMAP)", $LoginPOP3{$User}, $LoginIMAP{$User});
+ foreach my $Host (sort keys %{$Login{$User}}) {
+ $HostCount = $Login{$User}{$Host};
+ # Cleanly display IPv4 addresses
+ $Host=~ s/::ffff://;
+ printf "\n %4s %s", $Login{$User}{$Host}, $Host;
+ }
+ }
}
}
- print "\nTotal: $LoginCount successful logins";
}
if ( ( $Detail >= 10 ) and (keys %SieveLogin)) {
@@ -449,9 +438,16 @@ if (keys %LimitExceeded) {
}
if (keys %Disconnected) {
- print "\n\nDovecot disconnects:";
- foreach my $Reason (sort keys %Disconnected) {
- print "\n $Reason: $Disconnected{$Reason} Time(s)";
+ my $Disconnects = 0;
+ foreach my $Reason (%Disconnected) {
+ $Disconnects += $Disconnected{$Reason};
+ }
+ printf "\n" if ($Detail >= 5);
+ printf "\nDovecot disconnects: %s", $Disconnects;
+ if ($Detail >= 5) {
+ foreach my $Reason (sort keys %Disconnected) {
+ printf "\n %4s %s", $Disconnected{$Reason}, $Reason;
+ }
}
}
--
1.7.9.5
0004-Sort-the-connections-deliveries-logins-and-disconnec.patch
(text/x-patch, 6.6 KB)
Sort the connections, deliveries, logins, and disconnects by count
This makes it easier to see the most significant events.
Before (detail 5-9):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 40 40 203.0.113.133
0 13 13 203.0.113.153
0 24 24 203.0.113.19
0 4 4 198.51.100.248
0 5 5 192.0.2.143
0 1 1 192.0.2.115
0 41 41 172.23.45.67
------------------------------------------------------------------------
0 128 128 Total
Dovecot Deliveries: 107
107 user1
Dovecot IMAP and POP3 Successful Logins: 128
128 user1
Dovecot disconnects: 165
64 Disconnected in IDLE
33 Inactivity
4 Inactivity (no auth attempts)
16 Logged out
48 no auth attempts
After (detail 5-9):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 41 41 172.23.45.67
0 40 40 203.0.113.133
0 24 24 203.0.113.19
0 13 13 203.0.113.153
0 5 5 192.0.2.143
0 4 4 198.51.100.248
0 1 1 192.0.2.115
------------------------------------------------------------------------
0 128 128 Total
Dovecot Deliveries: 107
107 user1
Dovecot IMAP and POP3 Successful Logins: 128
128 user1
Dovecot disconnects: 165
64 Disconnected in IDLE
48 no auth attempts
33 Inactivity
16 Logged out
4 Inactivity (no auth attempts)
Before (detail 10+):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 40 40 203.0.113.133
0 13 13 203.0.113.153
0 24 24 203.0.113.19
0 4 4 198.51.100.248
0 5 5 192.0.2.143
0 1 1 192.0.2.115
0 41 41 172.23.45.67
------------------------------------------------------------------------
0 128 128 Total
Dovecot Deliveries: 107
107 user1
12 INBOX
1 INBOX/bar/as df
3 INBOX/bar/jkl
1 INBOX/bar/qwe rty
11 INBOX/baz/sub/gexvb
4 INBOX/baz/sub/rtnxa
5 INBOX/baz/sub/sdnbtr
1 INBOX/foo/bif/aqefa
69 INBOX/foo/bif/poisbsdfsrew
Dovecot IMAP and POP3 Successful Logins: 128
128 user1 (0 POP3, 128 IMAP)
40 203.0.113.133
13 203.0.113.153
24 203.0.113.19
4 198.51.100.248
5 192.0.2.143
1 192.0.2.115
41 172.23.45.67
Dovecot disconnects: 165
64 Disconnected in IDLE
33 Inactivity
4 Inactivity (no auth attempts)
16 Logged out
48 no auth attempts
After (detail 10+):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 41 41 172.23.45.67
0 40 40 203.0.113.133
0 24 24 203.0.113.19
0 13 13 203.0.113.153
0 5 5 192.0.2.143
0 4 4 198.51.100.248
0 1 1 192.0.2.115
------------------------------------------------------------------------
0 128 128 Total
Dovecot Deliveries: 107
107 user1
69 INBOX/foo/bif/poisbsdfsrew
12 INBOX
11 INBOX/baz/sub/gexvb
5 INBOX/baz/sub/sdnbtr
4 INBOX/baz/sub/rtnxa
3 INBOX/bar/jkl
1 INBOX/foo/bif/aqefa
1 INBOX/bar/as df
1 INBOX/bar/qwe rty
Dovecot IMAP and POP3 Successful Logins: 128
128 user1 (0 POP3, 128 IMAP)
41 172.23.45.67
40 203.0.113.133
24 203.0.113.19
13 203.0.113.153
5 192.0.2.143
4 198.51.100.248
1 192.0.2.115
Dovecot disconnects: 165
64 Disconnected in IDLE
48 no auth attempts
33 Inactivity
16 Logged out
4 Inactivity (no auth attempts)
diff --git a/scripts/services/dovecot b/scripts/services/dovecot
index 3428124..e444f8b 100755
--- a/scripts/services/dovecot
+++ b/scripts/services/dovecot
@@ -291,7 +291,8 @@ if ( ( $Detail >= 5 ) and (keys %Connection)) {
"\n" . "-" x 72;
$TLSInitFail = 0;
- foreach $Host (sort keys %Connection) {
+ foreach $Host (sort { $Connection{$b} <=> $Connection{$a} }
+ keys %Connection) {
$Total = $Connection{$Host};
if (defined ($ConnectionPOP3{$Host})) {
$Conns = $ConnectionPOP3{$Host};
@@ -326,10 +327,13 @@ if (keys %Deliver) {
printf "\n" if ($Detail >= 5);
printf "\nDovecot Deliveries: %s", $DeliverCount;
if ($Detail >= 5) {
- foreach my $User (sort keys %DeliverUserCount) {
+ foreach my $User (sort { $DeliverUserCount{$b} <=> $DeliverUserCount{$a} }
+ keys %DeliverUserCount) {
printf "\n %4s %s", $DeliverUserCount{$User}, $User;
if ($Detail >= 10) {
- foreach my $Mailbox (sort keys %{$Deliver{$User}}) {
+ foreach my $Mailbox (sort {
+ $Deliver{$User}{$b} <=> $Deliver{$User}{$a}
+ } keys %{$Deliver{$User}}) {
printf "\n %4s %s", $Deliver{$User}{$Mailbox}, $Mailbox;
}
}
@@ -392,11 +396,13 @@ if (keys %Login) {
printf "\n" if ($Detail >= 5);
printf "\nDovecot IMAP and POP3 Successful Logins: %s", $LoginCount;
if ($Detail >= 5) {
- foreach my $User (sort keys %LoginUserCount) {
+ foreach my $User (sort { $LoginUserCount{$b} <=> $LoginUserCount{$a} }
+ keys %LoginUserCount) {
printf("\n %4s %s", $LoginUserCount{$User}, $User);
if ($Detail >= 10) {
printf(" (%s POP3, %s IMAP)", $LoginPOP3{$User}, $LoginIMAP{$User});
- foreach my $Host (sort keys %{$Login{$User}}) {
+ foreach my $Host (sort { $Login{$User}{$b} <=> $Login{$User}{$a} }
+ keys %{$Login{$User}}) {
$HostCount = $Login{$User}{$Host};
# Cleanly display IPv4 addresses
$Host=~ s/::ffff://;
@@ -445,7 +451,8 @@ if (keys %Disconnected) {
printf "\n" if ($Detail >= 5);
printf "\nDovecot disconnects: %s", $Disconnects;
if ($Detail >= 5) {
- foreach my $Reason (sort keys %Disconnected) {
+ foreach my $Reason (sort { $Disconnected{$b} <=> $Disconnected{$a} }
+ keys %Disconnected) {
printf "\n %4s %s", $Disconnected{$Reason}, $Reason;
}
}
--
1.7.9.5
0005-Perform-reverse-DNS-lookups-on-Dovecot-remote-IP-add.patch
(text/x-patch, 6.2 KB)
Perform reverse DNS lookups on Dovecot remote IP addresses
Notes:
* Reverse DNS lookups are skipped if the 'numeric' config is true.
* The result of a reverse lookup is only used if the forward lookup
matches the original IP.
* The results are cached to reduce the number of DNS queries.
Before (detail 5-9):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 41 41 172.23.45.67
0 40 40 203.0.113.133
0 24 24 203.0.113.19
0 13 13 203.0.113.153
0 5 5 192.0.2.143
0 4 4 198.51.100.248
0 1 1 192.0.2.115
------------------------------------------------------------------------
0 128 128 Total
After (detail 5-9):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 41 41 dhcp-172-23-45-67.isp2.net
0 40 40 dhcp-203-0-113-133.isp.com
0 24 24 dhcp-203-0-113-19.isp.com
0 13 13 dhcp-203-0-113-153.isp.com
0 5 5 dhcp-192-0-2-143.company.com
0 4 4 dhcp-198-51-100-248.isp3.org
0 1 1 dhcp-192-0-2-115.company.com
------------------------------------------------------------------------
0 128 128 Total
Before (detail 10+):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 41 41 172.23.45.67
0 40 40 203.0.113.133
0 24 24 203.0.113.19
0 13 13 203.0.113.153
0 5 5 192.0.2.143
0 4 4 198.51.100.248
0 1 1 192.0.2.115
------------------------------------------------------------------------
0 128 128 Total
Dovecot IMAP and POP3 Successful Logins: 128
128 user1 (0 POP3, 128 IMAP)
41 172.23.45.67
40 203.0.113.133
24 203.0.113.19
13 203.0.113.153
5 192.0.2.143
4 198.51.100.248
1 192.0.2.115
After (detail 10+):
[Dovecot IMAP and POP3] Connections:
====================================
POP3 IMAP Total Host
------------------------------------------------------------------------
0 41 41 dhcp-172-23-45-67.isp2.net
0 40 40 dhcp-203-0-113-133.isp.com
0 24 24 dhcp-203-0-113-19.isp.com
0 13 13 dhcp-203-0-113-153.isp.com
0 5 5 dhcp-192-0-2-143.company.com
0 4 4 dhcp-198-51-100-248.isp3.org
0 1 1 dhcp-192-0-2-115.company.com
------------------------------------------------------------------------
0 128 128 Total
Dovecot IMAP and POP3 Successful Logins: 128
128 user1 (0 POP3, 128 IMAP)
41 dhcp-172-23-45-67.isp2.net
40 dhcp-203-0-113-133.isp.com
24 dhcp-203-0-113-19.isp.com
13 dhcp-203-0-113-153.isp.com
5 dhcp-192-0-2-143.company.com
4 dhcp-198-51-100-248.isp3.org
1 dhcp-192-0-2-115.company.com
diff --git a/scripts/services/dovecot b/scripts/services/dovecot
index e444f8b..b009467 100755
--- a/scripts/services/dovecot
+++ b/scripts/services/dovecot
@@ -100,6 +100,35 @@ if ( $Debug >= 5 ) {
print STDERR "\n\nDEBUG \n\n";
}
+use Socket;
+my $rdns = {};
+sub hostName {
+ (my $ipaddr) = @_;
+
+ if ($ENV{'LOGWATCH_NUMERIC'}) {
+ return $ipaddr;
+ }
+
+ if (exists $rdns{ $ipaddr }) {
+ return $rdns{ $ipaddr };
+ }
+ $rdns{ $ipaddr } = $ipaddr;
+
+ my $iaddr = inet_aton($ipaddr);
+ if (defined $iaddr) {
+ my $host = gethostbyaddr($iaddr, AF_INET);
+ if (defined $host) {
+ my $iaddrcheck = gethostbyname($host);
+ if (defined $iaddrcheck) {
+ if ($iaddr == $iaddrcheck) {
+ $rdns{ $ipaddr } = $host;
+ }
+ }
+ }
+ }
+ return $rdns{ $ipaddr };
+}
+
# Handle "dovecot: <svc>" and "dovecot: [ID yyyyy mail.info] <svc"
my $dovecottag = qr/dovecot:(?:\s*\[[^]]+\])?/;
@@ -126,6 +155,7 @@ while (defined($ThisLine = <STDIN>)) {
$End = 0;
} elsif ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Login: (.*?) \[(.*)\]/ ) ) {
if ($Host !~ /$IgnoreHost/) {
+ $Host = hostName($Host);
$Login{$User}{$Host}++;
$LoginPOP3{$User}++;
$ConnectionPOP3{$Host}++;
@@ -133,6 +163,7 @@ while (defined($ThisLine = <STDIN>)) {
}
} elsif ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Login: (.*?) \[(.*)\]/ ) ) {
if ($Host !~ /$IgnoreHost/) {
+ $Host = hostName($Host);
$Login{$User}{$Host}++;
$LoginIMAP{$User}++;
$ConnectionIMAP{$Host}++;
@@ -140,6 +171,7 @@ while (defined($ThisLine = <STDIN>)) {
}
} elsif ( ($User, $Host) = ( $ThisLine =~ /managesieve-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
if ($Host !~ /$IgnoreHost/) {
+ $Host = hostName($Host);
$SieveLogin{$User}{$Host}++;
$LoginSieve{$User}++;
$ConnectionSieve{$Host}++;
@@ -185,6 +217,7 @@ while (defined($ThisLine = <STDIN>)) {
# This is for Dovecot 1.0 series
} elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag pop3-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
if ($Host !~ /$IgnoreHost/) {
+ $Host = hostName($Host);
$Login{$User}{$Host}++;
$LoginPOP3{$User}++;
$ConnectionPOP3{$Host}++;
@@ -192,6 +225,7 @@ while (defined($ThisLine = <STDIN>)) {
}
} elsif ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag imap-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/) ) {
if ($Host !~ /$IgnoreHost/) {
+ $Host = hostName($Host);
$Login{$User}{$Host}++;
$LoginIMAP{$User}++;
$ConnectionIMAP{$Host}++;
@@ -227,6 +261,7 @@ while (defined($ThisLine = <STDIN>)) {
} elsif (($Reason, $Host) = ($ThisLine =~ /TLS initialization failed/) ) {
$TLSInitFail++;
} elsif (($Host) = ($ThisLine =~ /Aborted login \[(.*)\]/) ) {
+ $Host = hostName($Host);
$Aborted{$Host}++;
} elsif (($Reason) = ($ThisLine =~ /Aborted login \((.*)\):/)) {
$Aborted{$Reason}++;
--
1.7.9.5