On Tue, Feb 24, 2015 at 5:28 PM, Jan Ingvoldstad <[email protected]> wrote:
>
> If not the IP address, it would be nice to have some sort of unique
> session ID or similar for the logs, so that you could do single or dual
> pass parsing of logs.
>
> As it is now, log parsing is somewhat tedious.
>
>
Actually, it seems to be a bit worse than tedious. :(
I hoped I could, by using e.g. less to view the debug log (debug level 1),
identify login attempts (the below is an example, based on real log output):
[DATE] [host] imapd: Connection, ip=[::ffff:192.168.0.1]
[DATE] [host] authdaemond: received auth request, service=imap,
authtype=login
[DATE] [host] authdaemond: authuserdb: trying this module
[DATE] [host] authdaemond: userdb: looking up 'username'
[DATE] [host] authdaemond: userdb: entry not found
[DATE] [host] authdaemond: authuserdb: REJECT - try next module
[DATE] [host] authdaemond: FAIL, all modules rejected
[DATE] [host] imapd: LOGIN FAILED, method=PLAIN, ip=[::ffff:192.168.0.1]
That is, I hoped that the authdaemond entries would be buffered and put in
the log so that I could see which IP address tried to login as which user,
but failed.
Alas, that's not correct. (Courier-IMAP 4.16.0, Courier-Authlib 0.66.1)
Is there a way around this that I've missed?
--
Jan
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/
_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
