Re: Logwatch Dovecot Deliver Summary

Thank you so much for replying Orion. I will definitely give your suggestion a try and will let you know.  I can easily get back to its defaults in just practically a couple of clicks and my custom configuration will be gone. I’ve been there and done that before but it did not help. I first also started with defaults because this is how Logwatch is actually works right out of the box.

--See the attached files.  Replace
--/usr/share/logwatch/scripts/services/dovecot with the new dovecot script. 

My dovecot script here /usr/share/logwatch/scripts/services/dovecot is absolutely the same as your attached one.

--Install dovecot.conf into /etc/logwatch/conf/logfiles/dovecot.conf.
--Then edit your /usr/share/logwatch/default.conf/services/dovecot.conf to have:
--# Which logfile group...
--LogFile = dovecot
--#*OnlyService = (imap-login|pop3-login|dovecot)
--*RemoveHeaders = "^\w{3} .\d \d\d:\d\d:\d\d (?:[^\s:]* )?"


I have it configured like that as well as per my earlier emails. The difference is the name of the file. I called it mydovecot.conf for distinguishing purposes (yours is dovecot.conf) and you have the contents of it slightly different than mine so here’s where I will test it. I believe the OnlyService = line had #* in front of it and RemoveHeaders also had * in front of it by default as well if I am not mistaken.

--I'm curious as to what the difference between the /var/log/dovecot.log and /var/log/dovecot-info.log files is.


The difference is that /var/log/dovecot.log is for warning and errors, /var/log/dovecot-info.log is for info messages. The variable log_path is used by Dovecot for errors, info_log_path is for information, debug_log_path is for debugging and so on and they are usually set in your main Dovecot configuration file.

log_path = your path. Mine is var/log/dovecot.log
info_log_path = your path. Mine is /var/log/dovecot-info.log
debug_log_path = your path...

Detailed and exact info is here http://wiki2.dovecot.org/Logging

In fact, my customization is actually very very minimal. I only changed /declared two custom log files and then pointed Logwatch to them. There is only one file needed as far as I understand.

--I tried putting the new services/dovecot.conf into /etc/logwatch/conf/serivces, but then I ended up with a mish-mash of both configs.  Not sure what is going on there.

You must have some paths missing somewhere then or I did not quite understand it. I tried setting /etc/logwatch/conf/services and it worked fine. Documentation says that anything put into /etc/logwatch/conf is actually overrides /usr/share/logwatch/default.conf and things in /etc/logwatch/conf are executed first therefore originals are always kept untouched if you first copy-paste stuff from its original location to another /etc/logwatch location and do your modifications in your new location.

Regards,
Dennis.


From: Orion Poplawski 
Sent: Tuesday, May 13, 2014 06:16
To: Klaipedaville on Google ; [email protected] 
Subject: Re: [Logwatch-devel] Logwatch Dovecot Deliver Summary

On 05/10/2014 08:12 AM, Klaipedaville on Google wrote:
> Hey Orion,
> 
> Are there any more updates? Was my latest original dovecot-info.log file
> now 'feed-able' to Logwatch for parsing?
> 
> Is there anything else you may need in order to advise on my further
> actions in search for solutions?

Bringing this back to the list.

So, I see you are using a very custom configuration which logwatch does
not handle (as you well know), but should be able to.  You were quite
close, but the dovecot script needed some changes too.

See the attached files.  Replace
/usr/share/logwatch/scripts/services/dovecot with the new dovecot
script.  Install dovecot.conf into /etc/logwatch/conf/logfiles/dovecot.conf.

Then edit your /usr/share/logwatch/default.conf/services/dovecot.conf to
have:

# Which logfile group...
LogFile = dovecot

#*OnlyService = (imap-login|pop3-login|dovecot)
*RemoveHeaders = "^\w{3} .\d \d\d:\d\d:\d\d (?:[^\s:]* )?"

and see how that works for you.

I'm curious as to what the difference between the /var/log/dovecot.log
and /var/log/dovecot-info.log files is.

I tried putting the new services/dovecot.conf into
/etc/logwatch/conf/serivces, but then I ended up with a mish-mash of
both configs.  Not sure what is going on there.

- Orion

> 
> -----Original Message----- From: Klaipedaville on Google
> Sent: Saturday, May 10, 2014 00:22
> To: Orion Poplawski
> Subject: Re: [Logwatch-devel] Logwatch Dovecot Deliver Summary
> 
> Well, I have just changed the logrotate as it had one duplicate entry for
> dovecot-info.log and restarted dovecot and postfix.
> 
> Now the logs look a bit different but the entries "as if" from the
> output of
> Logwatch are still present. I have been there before as I had tried so many
> things for the past three days that it slipped my mind.
> 
> Here's how the output from Logwatch log looks now:
> 
>  May 09 22:57:08 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22308, TLS,
> session=<GC2xAP346ABWZGD7>: 1 Time(s)
>   May 09 22:57:26 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22310, TLS,
> session=<SRi/Af348ABWZGD7>: 1 Time(s)
>   May 09 23:02:07 lda([email protected]): Info:
> msgid=<20140509200203.339255F492@[email protected]>: saved mail to
> INBOX: 1
> Time(s)
>   May 09 23:04:42 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=23346, TLS,
> session=<gwm4G/34/gBWZGD7>: 1 Time(s)
>   May 09 23:04:47 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=23348, TLS,
> session=<GHwEHP34AgBWZGD7>: 1 Time(s)
>   May 09 15:39:39 lda([email protected]): Info:
> msgid=<5EF8D9A41E6940B5A4245960892EEF20@Computer>: saved mail to INBOX: 1
> Time(s)
>    May 09 16:11:24 lda([email protected]): Info:
> msgid=<20140509131124.796355F492@[email protected]>: saved mail to
> INBOX: 1
> Time(s)
>    May 09 17:02:02 lda([email protected]): Info:
> msgid=<20140509140202.4D6D25F492@[email protected]>: saved mail to
> INBOX: 1
> Time(s)
>   May 09 23:02:07 lda([email protected]): Info:
> msgid=<20140509200203.339255F492@[email protected]>: saved mail to
> INBOX: 1
> Time(s)
> 
> Here is how the "exact" output from my dovecot-info.log looks now:
> 
>   May 09 22:57:02 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22306, TLS,
> session=<LaRPAP345ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
>    May 09 22:57:08 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22308, TLS,
> session=<GC2xAP346ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
>    May 09 22:57:26 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22310, TLS,
> session=<SRi/Af348ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
> May 09 22:57:29 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22306, TLS,
> session=<LaRPAP345ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
>    May 09 22:57:38 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22308, TLS,
> session=<GC2xAP346ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
>    May 09 22:57:56 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22310, TLS,
> session=<SRi/Af348ABWZGD7>: 1 Time(s)
>  May 09 23:02:07 lda([email protected]): Info:
> msgid=<20140509200203.339255F492@[email protected]>: saved mail to
> INBOX: 1
> Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
> May 09 23:27:02 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22306, TLS,
> session=<LaRPAP345ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
>    May 09 23:45:08 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22308, TLS,
> session=<GC2xAP346ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
>    May 09 23:57:26 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22310, TLS,
> session=<SRi/Af348ABWZGD7>: 1 Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
> May 09 23:58:29 pop3-login: Info: Login: user=<[email protected]>,
> method=PLAIN, rip=68.101.69.152, lip=99.157.35.122, mpid=22306, TLS,
> session=<LaRPAP345ABWZGD7>: 1 Time(s)
> May 09 23:58:07 lda([email protected]): Info:
> msgid=<20140509200203.339255F492@[email protected]>: saved mail to
> INBOX: 1
> Time(s)
> May 10 00:07:52 pop3([email protected]): Info: Disconnected: Logged out
> top=0/0, retr=0/0, del=0/1, size=2386
> 
> Please, note that after checking / connecting / disconnecting it pops up
> this lda(... line anyway because it means which is pretty much obvious that
> the email safely arrived and was saved to my spool directory...
> 
> I am beginning to think to start looking at my Dovecot configuration and
> re-check it thoroughly one more time. It's working OK though but chances
> are
> that there is something missing in there somewhere. I can't really think of
> anything else at the moment.. Do you have any more ideas? Many thanks,
> really appreciate your assistance!
> 
> Regards,
> Dennis.
> 
> 
> -----Original Message----- From: Orion Poplawski
> Sent: Friday, May 9, 2014 22:36
> To: Klaipedaville on Google
> Subject: Re: [Logwatch-devel] Logwatch Dovecot Deliver Summary
> 
> On 05/09/2014 12:43 PM, Klaipedaville on Google wrote:
>> Thank you so much for responding and for giving it a try to help.
>>
>> I think I have to break it into steps as I have been experimenting with
>> it for three days and gradually starting to get lost and go crazy..
> 
> Thanks for the details, now we are getting somewhere.  But:
> 
>> 4. The custom logfile dovecot-info.log is absolutely the same as the
>> output from Logwatch.
>>
>> here is dovecot-info.log:
>>
>> **Unmatched Entries**
>>     lda(mail <mailto:mail-3Q2Tfjf0mexWk0Htik3J/[email protected]>@mydomain.
>> <mailto:mail@mydomain.>com): Info:
>> msgid=20140508183811.B746C622D3-i4yH9JU3wRtWVPTZF4YnfwC/[email protected]
>> <mailto:20140508183811.B746C622D3-i4yH9JU3wRtWVPTZF4YnfwC/[email protected]>: saved mail to
>> INBOX: 1 Time(s)
> 
> I'm sure this isn't dovecot-info.log, but the logwatch output.  Give me
> some lda lines *exactly* from dovecot-info.log.
> 


-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA/CoRA Division                    FAX: 303-415-9702
3380 Mitchell Lane                  [email protected]
Boulder, CO 80301              http://www.cora.nwra.com

------------------------------------------------------------------------------
"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
Instantly run your Selenium tests across 300+ browser/OS combos.
Get unparalleled scalability from the best Selenium testing platform available
Simple to use. Nothing to install. Get started now for free."
http://p.sf.net/sfu/SauceLabs

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel