Thanks Bill,
I modified the logwatch script in /etc/log.d/scripts/services/vpopmail to
give a count of successful login attempts instead of a line about each one:
near the beginning (under "# We don't care about these"):
} elsif (($ThisLine =~ /login success/)) {
$LoginSuccess++;
and at the end of the file:
if ($LoginSuccess) {
print "\nSuccessful logins: ". $LoginSuccess."\n";
}
Pretty amateurish (I don't know perl) but it gives me a count of successful
logins now - somewhere over 10,000 - which is much better, and I get to keep
the verbose logging for vpopmail (which I like) on.
David.
On Mon, 11 Oct 2004 11:59:30 -0700, Bill Shupp wrote
> David wrote:
>
> > Hi all,
> >
> > I have Bill's toaster installed and working correctly on a RedHat 9
> > install that is hosting a few e-mail domains (thanks Bill!). However
> > my logwatch logs are being flooded with thousands of entries in the
> > format:
> >
> > "vchkpw-pop3: (PLAIN) login success <user:ip-address>"
> >
>
> You can turn off logging in vpopmail if you want. Just remove the
> "--enable-logging=v" from your compilation line, and I believe it
> will default to --enable-logging=e.
>
> > under the heading "**Unmatched Entries**" in the vpopmail section.
> > Does anybody know how these get here, and especially why they're
> > appearing as _unmatched_ entries? My logwatch takes forever to process
> > on my mail client - it's currently sending around a 1 megabyte e-mail
> > each day.
> >
>
> That's either in syslog configuration, or logwatch configuration.
> I'm not sure which. I'd recommend tweaking this rather than turning
> off verbose logging. Those logs can be pretty useful, IMO.
>
> Regards,
>
> Bill
--
David Branford (www.davidbranford.net)
