Am 14.08.2013 17:12, schrieb Reindl Harald:
is it possible to get rid of the "proxy(test@testserver.rhsoft.net): started proxying to 127.0.0.1:143: " part because on a proxy-only server i know that and it is explicitly not listed in "login_log_format_elements"
got it
login_log_format_elements = user=<%u> method=%m rip=%r %k login_log_format = %s
which introduces the problem that POP3 is double-logged i guess ":msg, contains, "): disconnecting" ~" in rsyslog.conf no longer takes effect
Aug 14 22:54:37 mail dovecot: pop3-login: user=user@example.com, method=PLAIN, rip=80.120.xx.xx Aug 14 22:54:37 mail dovecot: pop3-login: user=user@example.com, method=PLAIN, rip=80.120.xx.xx
given that "example.com" has 60 addresses which are checked by a exchange connector every 3 minutes you can calculate the logsize by 2400 loglines per hour which could be 1200 without disconnect log
is there a option or would it not make sense in case "login_log_format = %s" skip the second line in default (non-debug) logging, most are gardly interested in how long a POP3 user took to receive his mails, the more interesting is how often, from which IPs and how much failed logins from where
thanks!