I am playing a bit with the monitoring, and I have noticed there
is
client of the chart with ~7500, while the others are between ~17 and ~60 (dovecot_user_num_cmds).
I assume this is related to the client, or is it possible something is wrong on the server side? Is someone having also such numbers or is
one this
really strange. Is it possible to limit these cmd's?
Maybe you should look into what command(s) are being executed first?
event_exporter cmd_export { format = json format_args = time-rfc3339 transport = log }
metric imap_command { event_name = imap_command_finished filter { user = anomalous } exporter = cmd_export }
Is there also a way to do this on dovecot 2.2?
With rawlogs, I suppose.
If I get this raw log, I am getting huge amount of lists
cut -d ' ' -f2 20201230-181651-16624.out |sort | uniq -c | sort -n
..
17 FLAGS
20 0
328 NO1284 ) 1284 9021 OK 133350 LIST