3 Apr
2007
3 Apr
'07
10:12 p.m.
On 19:52:38 2007-04-03 David Jonas djonas@vitalwerks.com wrote:
David Lee wrote:
We do some routine logfile (syslog) gathering and analysis. I've been looking at extending this to parse the syslog output of dovecot. Hmmm... ... For instance: pattern processing, at least with a reasonably hierarchical structure
- All lines, including the "deliver", to begin "dovecot:";
- The "IMAP(uuuu): Disconnected" to become "imap: disconnected user=<uuuu>"; ... Overall this would make it more consistently amenable to perl-like
to the messages. Perhaps something like:
dovecot: subprogram: event, key1=value1, key2=value2 ...
where: "subprogram" is "{imap,pop,deliver,...}"; "event" is "{login,disconnected, ...}; and one of the "key=value" will usually be "user=<uuuu>".
I acctually prefer the separate deliver and dovecot setup as it means I can log to separate files... But I guess the above mentioned would still work for me...