On Mon, 2009-02-02 at 11:16 -0800, Richard Stockton wrote:
At 10:10 AM 2/2/2009, you wrote:
On Mon, 2009-02-02 at 09:51 -0800, Richard Stockton wrote:
dovecot: Jan 29 16:35:03 Info: auth(default): master out: USER 1490 jennshinjo home=j/e/jennshinjo/Maildir/ uid=5000 gid=5000 home=j/e/jennshinjo/Maildir/ uid=5000 gid=5000 dovecot: Jan 29 16:35:03 Info: pop3-login: Internal login failure (auth failed, 1 attempts): user=<jennshinjo>, method=CRAM-MD5, rip=xx.xx.xx.xx, lip=10.255.0.11
You're missing the actual error message from the middle, since it's written to a different log file:
Hmmm, the only errors I see there look like this:
dovecot: Jan 29 16:35:03 Error: uid specified multiple times for jennshinjo
Right, that's the one.
and very occasionally I'll see an NFS error or a "Broken header", but neither seems to relate to the cram-MD5 problems.
These shouldn't happen either, could you show some of them?
log_path: /var/log/pop.log info_log_path: /var/log/dovecot-info.log
Why would you call Dovecot's error log pop.log?
Why not? Dovecot doesn't use it, and it's already set to logrotate, so I used it. I wanted it to be separate from the syslog. What would you suggest it be called?
I mean you call the info log so logically dovecot-info.log, why not error log dovecot-error.log? :) I'd think that you could easily forget to look at pop.log when errors happen.