[Dovecot] How to store Dovecot Logs in SQL DB
Hello!
I would like to put user login attempts into SQL DB (PostgreSQL). Any idea how to do it (without manual parsing log files)?
Kind regards, Krzysztof Kiszewski
This is not particularly dovecot specific or related, but I think the best approach is to redirect syslog messages to a SQL DB.
Searching google for "syslog postgresql" returns quite a few results...
good luck
On Fri, 2006-09-01 at 12:38 +0200, Krzysztof wrote:
Hello!
I would like to put user login attempts into SQL DB (PostgreSQL). Any idea how to do it (without manual parsing log files)?
Kind regards, Krzysztof Kiszewski
Hello Luca,
Friday, September 1, 2006, 2:46:36 PM, you wrote:
LC> This is not particularly dovecot specific or related, but I think the LC> best approach is to redirect syslog messages to a SQL DB. It is too generic solution, isn't it? In every specific case (apache, dovecot, postfix, etc.) table can be more specific than simple generic(host, datetime, facility, level, messagestring) tuple.
-- Best regards, Lev mailto:lev@serebryakov.spb.ru
On Fri, 2006-09-01 at 21:33 +0400, Lev Serebryakov wrote:
It is too generic solution, isn't it? In every specific case (apache, dovecot, postfix, etc.) table can be more specific than simple generic(host, datetime, facility, level, messagestring) tuple.
You could write some script which SELECTs data from the syslog generic table format and INSERTs it into a custom application specific table. You could also parse logfiles in the first place and then insert data into a database. But all this requires manual parsing of log files, which was explicitly excluded.
All depends on what the post author exactely needs to do. Generic question, generic answer.
Or are you trying to say that authentication logging to SQL should be a Dovecot feature?
Regards,
Luca
Or are you trying to say that authentication logging to SQL should be a Dovecot feature?
It would be great if Dovecot had that feature. I need it for quick view of users login history. Temporarily I did it with syslog-ng and postgresql, but it's not working as I would like it to be. It would be great if the log message format was easier to predict, because now it's quite hard to parse it correctly. One smaller thing I miss is to skip the same users succesfull logins if they were commited within 2 seconds (skip repeating messages). It happens when I log in thru SquirrelMail.
Krzysztof
On 2006-09-04 10:45:34 +0200, Krzysztof wrote:
Or are you trying to say that authentication logging to SQL should be a Dovecot feature?
It would be great if Dovecot had that feature. I need it for quick view of users login history. Temporarily I did it with syslog-ng and postgresql, but it's not working as I would like it to be. It would be great if the log message format was easier to predict, because now it's quite hard to parse it correctly. One smaller thing I miss is to skip the same users succesfull logins if they were commited within 2 seconds (skip repeating messages). It happens when I log in thru SquirrelMail.
i dunno if dovecot allows ";" in the queries if ";" is allow nothing stops you from modifying your password queries to do some sort of "INSERT"
darix
-- openSUSE - SUSE Linux is my linux openSUSE is good for you www.opensuse.org
On Mon, Sep 04, 2006 at 12:28:18PM +0200, Marcus Rueckert wrote:
i dunno if dovecot allows ";" in the queries if ";" is allow nothing stops you from modifying your password queries to do some sort of "INSERT"
this
is plain ugly
is asking for problems, if it works at all (better use PgSQL triggers then)
won't log extra information like client IP, SSL, ...
Geert
On Mon, 2006-09-04 at 10:45 +0200, Krzysztof wrote:
Or are you trying to say that authentication logging to SQL should be a Dovecot feature?
It would be great if Dovecot had that feature.
In Dovecot v2.0 I'm going to use separate log processes, which should then be somewhat easily replaceable with eg. perl scripts that log to database. Or whatever.
I need it for quick view of users login history.
You could do this by pointing mail_executable to a script:
#!/bin/sh
echo "INSERT INTO logins (user, time) VALUES ('$user', now())" | psql mails
exec /usr/local/libexec/dovecot/imap
Timo Sirainen writes:
In Dovecot v2.0 I'm going to use separate log processes, which should then be somewhat easily replaceable with eg. perl scripts that log to database. Or whatever.
How about syslog calls? Perhaps have the option of syslog or external files. Once you go to syslog then one could use one of the syslog daemons that can write to a DB.
I am a total Dovecot newbie.. so if dovecot already does syslog please disregard.. and let me know where/how to enable syslog. :-)
On Sun, 2006-10-08 at 22:15 -0400, Francisco Reyes wrote:
Timo Sirainen writes:
In Dovecot v2.0 I'm going to use separate log processes, which should then be somewhat easily replaceable with eg. perl scripts that log to database. Or whatever.
How about syslog calls? Perhaps have the option of syslog or external files. Once you go to syslog then one could use one of the syslog daemons that can write to a DB.
I am a total Dovecot newbie.. so if dovecot already does syslog please disregard.. and let me know where/how to enable syslog. :-)
You know, it logs to syslog by default. :)
It can be "enabled" by just leaving log_path setting empty.
Hi,
IIRC, syslog-ng has SQL-insert support. You would need to setup some filters to avoid non-dovecot related stuff.
Please note I haven't used this syslog-ng feature.
Charles
On ven, 2006-09-01 at 12:38 +0200, Krzysztof wrote:
Hello!
I would like to put user login attempts into SQL DB (PostgreSQL). Any idea how to do it (without manual parsing log files)?
Kind regards, Krzysztof Kiszewski
Charles Bueche <charles@bueche.ch> sand, snow, wave, wind and net -surfer
participants (8)
-
Charles Bueche
-
Francisco Reyes
-
Geert Hendrickx
-
Krzysztof
-
Lev Serebryakov
-
Luca Corti
-
Marcus Rueckert
-
Timo Sirainen