I am not sure if this is what you are looking for, but currently LogWatch does something quite similar, but the results are sent via an email, and, granted, they could be a bit more verbose but it is only going by what dovecot logs to syslog..

-Rich

[IMAPd] Connections:

                              Host | Connections |    SSL   |   Total  

-------------------------------------- | ----------- | -------- | --------- [192.168.6.10] | 7 | 0 | 7 [192.168.6.2] | 8 | 0 | 8 [192.168.6.3] | 5 | 0 | 5 [68.44.18.33] | 14 | 0 | 14 [68.6.116.208] | 2 | 0 | 2 [69.11.57.131] | 1 | 0 | 1 [70.104.7.3] | 5 | 0 | 5

                                              42 |        0 |        42

[POP3] Connections:

                                                     Host | Connections

------------------------------------------------------------- | ----------- [24.25.30.219] | 250 [8.46.16.208] | 5 [70.1.11.86] | 8

                                                                    263

Thanks for the suggestions. I guess I could have articulated my question a little better.

Ideally, I'd like to have the user's protocol and timestamp recorded when they check mail into a database. I'd rather not modify dovecot itself - seems like that would be a project itself just to maintain.

The only idea I'm coming up with so far is to grep the logfile for each user in the manner you suggest on cron job (late at night while the server is bored), parse the results, and record them into a database. The downfall is that it's not real time.

I can't help but wonder if I'm reinventing the wheel here. Is someone else doing something like this?