Having FC3 systems and utilizing Dovecot, I have come to rely on some of the information I get from the daily logwatch run. Logwatch, by default, doesn't properly recognize dovecot's information in the messages file, but it is easy to tweak. The patch below will give you some statistics regarding POP3 and IMAP usage. I believe I grabbed all of the differences in the unified diff below. If I missed anything, please post. :) -Rich --- /etc/log.d/conf/services/imapd.conf 2005-04-15 14:24:52.000000000 -0400 +++ /etc/log.d/conf/services/imapd.conf 2005-04-15 14:51:52.073609243 -0400 @@ -20,7 +20,7 @@ # Only give lines pertaining to courier... # I'm not sure if this is complete, especially for the new webmail daemon in 0.44.1 #but you will get at least all currently supported logs -*OnlyService = (imapd|imapd-ssl) +*OnlyService = (imap-login|imapd|imapd-ssl) *RemoveHeaders = --- /etc/log.d/conf/services/pop3.conf 2005-04-15 14:51:22.795813799 -0400 +++ /etc/log.d/conf/services/pop3.conf 2005-04-15 15:07:00.837019392 -0400 @@ -15,12 +15,12 @@ Title = "POP-3" # Which logfile group... -LogFile = messages +LogFile = maillog # Only give lines pertaining to courier... # I'm not sure if this is complete, especially for the new webmail daemon in 0.44.1 #but you will get at least all currently supported logs -*OnlyService = (pop3d-ssl|pop3d|spop3d) +*OnlyService = (pop3-login|pop3d-ssl|pop3d|spop3d) *RemoveHeaders = --- /etc/log.d/scripts/services/pop3 2005-04-15 15:15:28.727123168 -0400 +++ /etc/log.d/scripts/services/pop3 2005-04-15 15:03:47.402606350 -0400 @@ -58,6 +58,8 @@ # Don't care about these... } elsif ( ($User, $Host) = ( $ThisLine =~ /^user (.*?) authenticated - (.*)$/ ) ) { $Login{$User}{$Host}++; + } elsif ( ($User, $Host) = ( $ThisLine =~ /Login: (.*?) (\[.*\])/ ) ) { + $Login{$User}{$Host}++; } elsif ( ($User,$Downloaded,$DownloadSize,$Left,$LeftSize) = ( $ThisLine =~ /^Stats: (.*?) (.*?) (.*?) (.*?) (.*?)$/) ) { $DownloadedMessages{$User} += $Downloaded; $DownloadedMessagesSize{$User} += $DownloadSize; --- /etc/log.d/scripts/services/imapd 2005-04-15 15:15:20.742084824 -0400 +++ /etc/log.d/scripts/services/imapd 2005-04-15 15:04:39.868698875 -0400 @@ -43,6 +43,9 @@ # Don't care about these... } elsif ( ($User, $Host) = ( $ThisLine =~ /^Login user=(.*?) host=(.* \[.*\])$/ ) ) { $Login{$User}{$Host}++; + } elsif ( ($User, $Host) = ( $ThisLine =~ /Login: (.*?) (\[.*\])/ ) ) { + $ConnectionNonSSL{$Host}++; + $Connection{$Host}++; } elsif ( ($User,$Host) = ( $ThisLine =~ /^Authenticated user=(.*) host=(.* \[.*\])$/ ) ) { $Login{$User}{$Host}++; } elsif ( ($User,$Host) = ( $ThisLine =~ /^Preauthenticated user=(.*) host=(.*)$/ ) ) {