rawlog

[Aki Tuomi]

> On August 3, 2017 at 8:57 PM Alexander Dalloz <ad+lists at uni-x.org> wrote:
> 
> 
> Am 03.08.2017 um 01:04 schrieb Matt Bryant:
> > Hi,
> > 
> > Trying to get rawlog working on dovecot 2.2.31 configured as per
> > 
> > https://wiki2.dovecot.org/Debugging/Rawlog
> > 
> > but
> > 
> > a) it doesnt appear to be loggin anything
> > b) rawlog_dir which is supposed to be v2.2.26+ seems no where in site ..
> > in fact complains about unknown variable
> > 
> > So does rawlog still do anything ???? Or am I missing something ...
> > config is below ....
> > 
> > 
> > # 2.2.19: /etc/dovecot/dovecot.conf
> 
> You run dovecot 2.2.19, not v2.2.26+.
> 
>  From where did you take that specific version? CentOS 7 ships dovecot 
> 2.2.10. I can recommend the usage of the dovecot packages from the 
> ghettoforge.org repository. Then you are current (2.2.31 actually).
> 
> > # Pigeonhole version 0.4.9 (357ac0a0e68b+)
> > doveconf: Warning: service auth { client_limit=30000 } is lower than
> > required under max. load (150032)
> > doveconf: Warning: service anvil { client_limit=22000 } is lower than
> > required under max. load (50027)
> > # OS: Linux 3.10.0-327.4.4.el7.x86_64 x86_64 CentOS Linux release
> > 7.2.1511 (Core)
> 
> Please, keep your systems up to date! At least your kernel is terribly 
> out of date.
> 
> Regards
> 
> Alexander

Most common mistake with rawlogs is to assume that the target directory gets created. It doesn't.

You need to make sure the target directory exists fully expanded, e.g. if you have target directory /tmp/rawlogs/%u, you need to create /tmp/rawlogs/victim and chmod it to 0777.

Aki