I just launched a new mailserver that is using dovecot. My previous mailserver used courier-mail. I am expecting better things with this new server, but I was use to some login information in logwatch that I am not seeing now. For example I would get:
[IMAPd] Logout stats:
User | Logouts | Downloaded | Mbox Size--------------------------------------- | ------- | ---------- | ---------- user1@htt-consult.com | 55 | 219571 | 0 user2@htt-consult.com | 285 | 221681 | 0 user3@labs.htt-consult.com | 32 | 15183 | 0
372 | 456435 | 0**Unmatched Entries** Disconnected, ip=[::ffff:107.150.52.84], time=1, starttls=1: 2 Time(s)
---------------------- IMAP End -------------------------
--------------------- POP-3 Begin ------------------------
[POP3] Logout stats (in MB):
User | Logouts | Downloaded | Mbox Size--------------------------------------- | ------- | ---------- | ---------- user1@htt-consult.com | 78 | 5.96 | 0 user2@communaljob.com | 215 | 9.24 | 0 user3@htt-consult.com | 1 | 7.47 | 0 user4@htt-consult.com | 1 | 2.34 | 0 user5@htt-consult.com | 301 | 31.08 | 0 user6@labs.htt-consult.com | 201 | 4.98 | 0
797 | 61.06 | 0.00**Unmatched Entries** Disconnected, ip=[::ffff:107.150.52.84]: 2 Time(s) Disconnected, ip=[::ffff:12.159.43.147]: 50 Time(s) Disconnected, ip=[::ffff:172.245.45.20]: 61 Time(s) LOGIN FAILED, user=Alfredo, ip=[::ffff:172.245.45.20]: 1 Time(s) LOGIN FAILED, user=Antonio, ip=[::ffff:172.245.45.20]: 2 Time(s) LOGIN FAILED, user=postmaster, ip=[::ffff:172.245.45.20]: 7 Time(s) .... LOGIN FAILED, user=webmaster, ip=[::ffff:172.245.45.20]: 7 Time(s) LOGIN FAILED, user=www, ip=[::ffff:172.245.45.20]: 4 Time(s) Maximum connection limit reached for ::ffff:172.245.45.20: 509 Time(s)
---------------------- POP-3 End -------------------------
Whereas dovecot is only reporting:
--------------------- Dovecot Begin ------------------------
Dovecot disconnects: Inactivity: 1 Time(s) Logged out: 379 Time(s) no auth attempts: 5 Time(s) no reason: 1 Time(s) tried to use disabled plaintext auth: 1 Time(s)
**Unmatched Entries** dovecot: dict: mysql: Connected to localhost (postfix): 351 Time(s)
---------------------- Dovecot End -------------------------
How can I get more detailed user activity reporting to logwatch?
And why is connection to mysql under Unmatched Entries?