[dovecot] Re: Logging suggestions?

[Amelia A Lewis]

On Wed, Jan 08, 2003 at 11:50:06AM -0600, David Champion wrote:
>* On 2003.01.08, in <1042022871.28651.93.camel at hurina>,
>*	"Timo Sirainen" <tss at iki.fi> wrote:
>> Any suggestions how user login/logouts should look like in log files? I
>> was thinking:

[snip]

>> I think the only configuration needed would be if to log login, logout
>> or both.
>
>That's generous. :) I'd always want both, and can't imagine not wanting
>both, but I suppose some might prefer less.

I'd like to see at least the option of showing failed logins, for security
monitoring.  In some ways, I want to see this more than I want to see
successful logins.

>I actually wouldn't mind seeing more optional logs -- for example,
>logout-like summaries for folder accesses (when users change folders).
>This can help in balancing storage devices when folders can reside on
>multiple devices.

+1

Might think about what can be logged per-module.  That is, imap-login knows
about connection attempts; imap-auth about who and how (auth mechanism);
imap about folders accessed, bytes transferred.  Might think about a set of
keywords for each, then, like this:

imap_login_logging: connection login logout starttls
imap_auth_logging: user auth success failure
imap_logging: folders num_messages num_bytes per_folder

Amy!
-- 
Amelia A. Lewis                    amyzing {at} talsever.com
Better to have thirty minutes of wonderful than a lifetime of nothing
special.