Re: Logwatch Dovecot Deliver Summary

Hello Patrick,

Well, this is to report back that unfortunately your suggested solutions did not work.

I tried your both versions with (.Info:)? from your first email and (Info:)? from your second email. It keeps on saying that all the entries are unmatched anyway. That is there is nothing else but unmatched entries only. The example-extract is down below.

Since the word 'info' goes as an option we need to figure out how to turn off that option as I think it still keeps on being used with your change proposed.

I was also wondering is it actually supposed to generate a separate log line per connection? What I have Logwatch reporting at the moment is exactly the line per connection. For example if the user mail-3Q2Tfjf0mexWk0Htik3J/[email protected] connects 1258 times per day then it means I’ll have 1258 lines in my daily mail plus extra lines if mail was saved to inbox, and this is for one user only as per example below. If for instance I have 20 or 70 users I’ll be simply flooded with Dovecot entries. I believe summary reports would be much better in this case. Could you also please, throw some light onto that matter as well? Many thanks!


**Unmatched Entries**
    May 11 02:02:05 lda(mail-3Q2Tfjf0mexWk0Htik3J/[email protected]): Info: msgid=20140510230204.9D48E5DEA4-i4yH9JU3wRtWVPTZF4YnfwC/[email protected]: saved mail to INBOX: 1 Time(s)
    May 11 03:02:10 lda(mail-3Q2Tfjf0mexWk0Htik3J/[email protected]): Info: msgid=<20140511000208.1F774622E1-i4yH9JU3wRtWVPTZF4YnfwC/[email protected]>: saved mail to INBOX: 1 Time(s)
    May 11 04:02:13 lda(mail-3Q2Tfjf0mexWk0Htik3J/[email protected]): Info: msgid=<20140511010209.BCC87622E1-i4yH9JU3wRtWVPTZF4YnfwC/[email protected]>: saved mail to INBOX: 1 Time(s)
    May 11 09:48:49 pop3-login: Info: Login: user=<mail-3Q2Tfjf0mexWk0Htik3J/[email protected]>, method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, mpid=4220, TLS, session=<53gdORr5KwBWZGD7>: 1 Time(s)
    May 11 09:48:49 pop3-login: Info: Login: user=<mail-3Q2Tfjf0mexWk0Htik3J/[email protected]>, method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, mpid=4219, TLS, session=<SnUdORr58ABWZGD7>: 1 Time(s)
    May 11 10:02:03 lda(mail-3Q2Tfjf0mexWk0Htik3J/[email protected]): Info: msgid=<20140511070202.E892F622DF-i4yH9JU3wRtWVPTZF4YnfwC/[email protected]>: saved mail to INBOX: 1 Time(s)
    May 11 10:10:43 pop3-login: Info: Login: user=<mail-3Q2Tfjf0mexWk0Htik3J/[email protected]>, method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, mpid=5314, TLS, session=<GmJ1hxr5ZwBWZGD7>: 1 Time(s)
    May 11 10:10:44 pop3-login: Info: Login: user=<mail-3Q2Tfjf0mexWk0Htik3J/[email protected]>, method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, mpid=5315, TLS, session=<Fy54hxr5bwBWZGD7>: 1 Time(s)
    May 11 10:17:41 pop3-login: Info: Login: user=<mail-3Q2Tfjf0mexWk0Htik3J/[email protected]>, method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, mpid=5369, TLS, session=<RclXoBr5HgBWZGD7>: 1 Time(s)
    May 11 20:57:13 pop3-login: Info: Login failed: Plaintext authentication disabled: user=<>, rip=177.189.236.37, lip=5.6.7.8, session=<p619jyP5oACxvewl>: 1 Time(s)
    May 11 20:57:14 pop3-login: Info: Login failed: Plaintext authentication disabled: user=<>, rip=177.189.236.37, lip=5.6.7.8, session=<50iRjyP5AwCxvewl>: 1 Time(s)
    May 11 20:57:14 pop3-login: Info: Login failed: Plaintext authentication disabled: user=<>, rip=177.189.236.37, lip=5.6.7.8, session=<RMyHjyP50gCxvewl>: 1 Time(s)



I thank you for your time and look forward to hearing from you soon again.

Regards,
Dennis.



From: Patrick Vande Walle 
Sent: Saturday, May 10, 2014 14:55
To: Klaipedaville on Google ; Mike Tremaine ; Patrick Vande Walle 
Cc: [email protected] ; [email protected] 
Subject: Re: [Logwatch-devel] Logwatch Dovecot Deliver Summary

Dennis,

This is a diff file, which is applied with the patch command.

However, the change being really small, you could also do it with a text
editor

- Open /usr/share/logwatch/scripts/services/dovecot  with a text editor

- Look for the line starting with
    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag
(?:lda|deliver)\((.*)\): msgid=.*: saved mail to (\S+)/ ) ) {

- Replace it with:
  } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag
(?:lda|deliver)\((.*)\):(.Info:)? msgid=.*: saved mail to (\S+)/ ) ) {

- Save.

- Test with "logwatch --output stdout --service dovecot" to see if it works.
You may need to tweak the regex. Perl regex syntax is essentially the
same as PHP. Your PHP knowledge will help.  

The reason  why the original regex fails is that the developer added the
word "Info:" before "msgid" in later versions of the 2.x series. The
proposed change allows this word as an option.

Regards,
Patrick


On 10/05/14 12:16, Klaipedaville on Google wrote:
> Hello Patrick,
>
> Thank you so much for replying and for your suggestion. I will try it
> and let you know.
>
> Although I am not quite sure where do I insert the first part that
> starts from --- dovecot.orig and ends on @@ ?
>
> This is the code:
>  --- dovecot.orig 2014-05-10 09 <tel:2014051009>:45:39.795499290
> <tel:39795499290> +0200 +++ dovecot 2014-05-10 10
> <tel:2014051010>:01:25.538429031 <tel:25538429031> +0200 @@ -179,7
> +179,7 @@
>
> The last time I tried it my perl complained on @ and -179,7 +179,7 and
> symbols like this being syntax errors.
>
> Many thanks! I really do appreciate your help!
>
> Regards,
> Dennis.
>
>
>
> -----Original Message-----
> From: Patrick Vande Walle <[email protected]>
> To: Klaipedaville on Google <[email protected]>, Mike Tremaine
> <mgt-DY+kYuDXiUrz68fS/h/[email protected]>
> Cc: [email protected], [email protected]
> Sent: Sat, 10 May 2014 11:09
> Subject: Re: [Logwatch-devel] Logwatch Dovecot Deliver Summary
>
> Dennis,
>
> Please try the following patch:
>
> --- dovecot.orig    2014-05-10 09 <tel:2014051009>:45:39.795499290
> <tel:39795499290> +0200
> +++ dovecot    2014-05-10 10 <tel:2014051010>:01:25.538429031
> <tel:25538429031> +0200
> @@ -179,7 +179,7 @@
>        }
>  
>  # 'lda' for dovecot 2.0, 'deliver' for earlier versions
> -    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag
> (?:lda|deliver)\((.*)\): msgid=.*: saved mail to (\S+)/ ) ) {
> +    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag
> (?:lda|deliver)\((.*)\):( Info:)? msgid=.*: saved mail to (\S+)/ ) ) {
>        $Deliver{$User}{$Mailbox}++;
>  
>  # For Sieve-based delivery
>
> This is untested. My system uses the Sieve lda, which returns other
> strings.
> If it works for you, please report back so Mike can update the sources.
>
> Regards,
>
> Patrick Vande Walle
>
>
>

------------------------------------------------------------------------------
"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
Instantly run your Selenium tests across 300+ browser/OS combos.
Get unparalleled scalability from the best Selenium testing platform available
Simple to use. Nothing to install. Get started now for free."
http://p.sf.net/sfu/SauceLabs

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel