5 May
2006
5 May
'06
5:25 p.m.
On Fri, 2006-05-05 at 08:21 -0400, Edward Chase wrote:
May 5 07:20:22 postoffice qpopper[8770]: [ID 702911 mail.notice] Stats: popuser 91 2173068 116 2543535 10.1.2.3 10.1.2.3
This is telling me that popuser checked mail. The qpopper removed 91 messages / 2173068 bytes from the mailbox, leaving 116 messages / 2173068 bytes. And the operation was done by the machine at 10.1.2.3
Dovecot should be logging the same things for POP3. In config file:
pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
Then again, if you're using v0.99.x it doesn't do that.
I would also hope that attempts to do POP with bad username/password combos would be logged w/ at least the username showing up.
Set auth_verbose = yes