On Wed, Jan 08, 2003 at 11:50:06AM -0600, David Champion wrote:
- On 2003.01.08, in 1042022871.28651.93.camel@hurina,
- "Timo Sirainen" tss@iki.fi wrote:
Any suggestions how user login/logouts should look like in log files? I was thinking:
[snip]
I think the only configuration needed would be if to log login, logout or both.
That's generous. :) I'd always want both, and can't imagine not wanting both, but I suppose some might prefer less.
I'd like to see at least the option of showing failed logins, for security monitoring. In some ways, I want to see this more than I want to see successful logins.
I actually wouldn't mind seeing more optional logs -- for example, logout-like summaries for folder accesses (when users change folders). This can help in balancing storage devices when folders can reside on multiple devices.
+1
Might think about what can be logged per-module. That is, imap-login knows about connection attempts; imap-auth about who and how (auth mechanism); imap about folders accessed, bytes transferred. Might think about a set of keywords for each, then, like this:
imap_login_logging: connection login logout starttls imap_auth_logging: user auth success failure imap_logging: folders num_messages num_bytes per_folder
Amy!
Amelia A. Lewis amyzing {at} talsever.com Better to have thirty minutes of wonderful than a lifetime of nothing special.