logging verbosity
Hello,
I get lots of these messages in the log:
dovecot: imap-login: Login: user@1.2.3.4, TLSv1.3 with ..
dovecot: imap(user)<10889><glzsCIi6AMbUGQtL>: Disconnected for
inactivity ...
dovecot: imap(user)<10887>
when user clicks on folder in Thunderbird, or sometimes even when the Thunderbird window is in focus (without clicking anything).
Anyway, how can I suppress these info messages, while keeping the important ones, such as auth problems?
I am using Dovecot v2.3.4.1 with 10-logging.conf with default values. I see there is this line:
# Log unsuccessful authentication attempts and the reasons why they failed. auth_verbose = yes
I definitely want to keep logging unsuccessful auth, but how can I suppress the verbose rest?
and lastly, can these settings be set per-user?
Can I suppress verbose for user 'bob' but keep for others?
thanks,
On 05/02/2021 05:17, Fourhundred Thecat wrote:
Hello,
I get lots of these messages in the log:
dovecot: imap-login: Login: user@1.2.3.4, TLSv1.3 with .. dovecot: imap(user)<10889><glzsCIi6AMbUGQtL>: Disconnected for inactivity ... dovecot: imap(user)<10887>
: Logged out ... when user clicks on folder in Thunderbird, or sometimes even when the Thunderbird window is in focus (without clicking anything).
Anyway, how can I suppress these info messages, while keeping the important ones, such as auth problems?
I am using Dovecot v2.3.4.1 with 10-logging.conf with default values. I see there is this line:
# Log unsuccessful authentication attempts and the reasons why they failed. auth_verbose = yes
I definitely want to keep logging unsuccessful auth, but how can I suppress the verbose rest?
and lastly, can these settings be set per-user?
Can I suppress verbose for user 'bob' but keep for others?
grep -v ?
Seriously, whether you view logs in a web application or at the commandline, having a way to filter them is essential. And if you have common filters, being able to to pre-program them is useful. Once in a blue moon, it's maybe useful to know something about how a user is getting on or a problem s/he's having.
-- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255
On 2021-02-05 06:00, Jeff Abrahamson wrote: On 05/02/2021 05:17, Fourhundred Thecat wrote:
Hello,
I definitely want to keep logging unsuccessful auth, but how can I suppress the verbose rest?
and lastly, can these settings be set per-user?
Can I suppress verbose for user 'bob' but keep for others?
grep -v ?
Seriously, whether you view logs in a web application or at the commandline, having a way to filter them is essential. And if you have common filters, being able to to pre-program them is useful. Once in a blue moon, it's maybe useful to know something about how a user is getting on or a problem s/he's having.
thank you, but can this not be configured in dovecot?
rather than logging everything and then filtering with grep.
On 05/02/2021 08:11 Fourhundred Thecat 400thecat@gmx.ch wrote:
On 2021-02-05 06:00, Jeff Abrahamson wrote: On 05/02/2021 05:17, Fourhundred Thecat wrote:
Hello,
I definitely want to keep logging unsuccessful auth, but how can I suppress the verbose rest?
and lastly, can these settings be set per-user?
Can I suppress verbose for user 'bob' but keep for others?
grep -v ?
Seriously, whether you view logs in a web application or at the commandline, having a way to filter them is essential. And if you have common filters, being able to to pre-program them is useful. Once in a blue moon, it's maybe useful to know something about how a user is getting on or a problem s/he's having.
thank you, but can this not be configured in dovecot?
rather than logging everything and then filtering with grep.
There are events that can be used to generate log entries, but they are not as pretty. But you can turn off auth_verbose at least.
event_exporter log-export { format = json format_args = time-rfc3339 transport = log }
metric auth_failures { exporter = log-export filter = event=auth_request_finished AND NOT success=yes }
Requires 2.3.13+
Aki
On 04 Feb 2021, at 23:11, Fourhundred Thecat 400thecat@gmx.ch wrote:
On 2021-02-05 06:00, Jeff Abrahamson wrote: On 05/02/2021 05:17, Fourhundred Thecat wrote:
Hello,
I definitely want to keep logging unsuccessful auth, but how can I suppress the verbose rest?
and lastly, can these settings be set per-user?
Can I suppress verbose for user 'bob' but keep for others?
grep -v ?
Seriously, whether you view logs in a web application or at the commandline, having a way to filter them is essential. And if you have common filters, being able to to pre-program them is useful. Once in a blue moon, it's maybe useful to know something about how a user is getting on or a problem s/he's having.
thank you, but can this not be configured in dovecot?
Maybe a utility like rsyslog which allows filtering specific messages into specific logs? For example, I create a "delivery.log" that lists just the log lines from mail.log for delivered messages:
if $msg contains 'status=sent' then /var/log/delivery.log if $msg contains 'permit: DATA' then /var/log/delivery.log
And another that creates a log file just for the pop3 logins (I only allow users to use POP3 to fetch mail to their gmail accounts since forwarding to gmail simply does not work reliably, so this log is useful).
-- I get the feeling that some people's idea of heaven is an "I told you so" T-shirt - mmalc
On Fri, Feb 05, 2021 at 05:17:01AM +0100, Fourhundred Thecat wrote:
auth_verbose = yes
I definitely want to keep logging unsuccessful auth, but how can I suppress the verbose rest?
I log everything for potential troubleshooting but I have a filter configured in the syslog daemon which logs more interesting messages to a separate file. It is easier to browse manually this way. I use syslog-ng and its source/filter/destination syntax, but there are other possibilities as well. I would recommend such approach, unless you're really tight on disk space/throughput.
-- Piotr "Malgond" Auksztulewicz firstname@lastname.net
participants (5)
-
＠lbutlr
-
Aki Tuomi
-
Fourhundred Thecat
-
Jeff Abrahamson
-
Piotr Auksztulewicz