[Dovecot] Fail2Ban and the Dovecot log

[Lou Duchez]

Bill Landry wrote:
> Timo Sirainen wrote:
>   
>> On Mon, 2009-05-11 at 17:15 -0400, Lou Duchez wrote:
>>     
>>> Re: the "dovecot: " at the beginning of the line in the log.  I should 
>>> mention that other applications encounter a similar issue with Fail2Ban 
>>> -- for example, if you're running Asterisk, you have to alter the log 
>>> format such that the timestamp is at the beginning of the line:
>>>       
>> If you log via syslog, the timestamp will be at the beginning of line.
>>     
>
> Well, then that would explain it.  Maybe it would be a good idea then to
> remove the "dovecot: " from the beginning of each log line when not
> using syslog for logging, since I'm pretty sure that anyone checking the
> "dovecot.log" would know that it was the "dovecot" log they were looking
> at (no need to remind then at the beginning of each and every line).  ;-)
>
> Bill
>
>   

Maybe there could be a page in the dovecot wiki about Fail2Ban?  A 
definitive Dovecot / Fail2ban resource would be useful.  (If nobody else 
creates one in a week, perhaps I will.  But I have to perfect my 
Fail2banning first ...)

Thanks, guys, for helping me out!