> > here's what you look for, a POP3 logon + logoff with this guy's name
> > and mailhost:
> >
> > 09:29 14:06 POP3D(00000275) logon success for lconrad
> > mail.Go2France.com from ip.ad.re.ss
> > 09:29 14:06 POP3D(00000275) logoff for lconrad R:7, D:7, P:0
> >
> > Note the POP3D (pid) must be the same.
>
>So, I'm looking for a successful and a logoff in the same minute
not necessarily in the same minute, but for every logon for a pid,
you want to find a logoff for that pid and user, otherwise the POP3D
probably is going to be in the wrong state the next a he log's on. I
have had this happen to me when I had accessed my mailbox from Paris
to Columbus OH over SprintLimp. The connection was so bad between
East coast USA and OH that Imail and Eudora would really get out of sync.
>or are you talking about the R:, D:, and P: values? This is an
>example of a successful login right?
You turn on POP3 logging for a few minutes since he logs in every 2
minutes, and then turn it off to keep the log small.
Len
http://BIND8NT.MEIway.com: ISC BIND 8.2.2 p5 installable binary for NT4
http://IMGate.MEIway.com: Build free, hi-perf, anti-spam mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
