The dovecot logs to syslog to the /var/log/maillog # Syslog facility to use if you're logging to syslog. Usually if you don't # want to use "mail", you'll use local0..local7. Also other standard # facilities are supported. syslog_facility = mail
And in SYSLOG.CONF mail.* /var/log/maillog The message I reported in taken from /var/log/maillog So... Actualy I do not receive any Error message from dovecot... Looks like dovecot rely on the error message of winbind and doesn't log any more message... Possible? Strange ? > -----Messaggio originale----- > Da: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > g] Per conto di [EMAIL PROTECTED] > Inviato: sabato 15 dicembre 2007 15.16 > A: '[EMAIL PROTECTED] Samba. Org' > Oggetto: Re: [Samba] unauthorized acess attempt > > Gianluca Culot wrote: > > Hello list > > > > I'm facing a little security problem > > > > I get A LOT (3 a minute) a such a message > > > > mail dovecot-auth: pam_winbind(dovecot): request failed: No such > > user, PAM error was unknown user (13), NT error was > > NT_STATUS_NO_SUCH_USER > > > > I'd like to know which is the user name used in such > attempts How can > > I get such info without raising log level to an inacceptable level > > (which would cause my log file to explode !?! ) > > Have you looked at your dovecot logs to see who's trying to > login at that time? > > Don Piven > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/listinfo/samba > -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba