[dovecot] Re: Logging suggestions?

[Timo Sirainen]

On Wed, 2003-01-08 at 20:11, Amelia A Lewis wrote:
> I'd like to see at least the option of showing failed logins, for security
> monitoring.  In some ways, I want to see this more than I want to see
> successful logins.

Currently it just says "Aborted login". I was planning on adding "n
failed login attempts" before that or actual login.

> Might think about what can be logged per-module.  That is, imap-login knows
> about connection attempts; imap-auth about who and how (auth mechanism);
> imap about folders accessed, bytes transferred.  Might think about a set of
> keywords for each, then, like this:
> 
> imap_login_logging: connection login logout starttls
> imap_auth_logging: user auth success failure
> imap_logging: folders num_messages num_bytes per_folder

Something like that, yes. I'd like to avoid adding too many (mostly)
useless options though.