[Dovecot] Dovecot Log analysis

[Timo Sirainen]

On Mon, 2011-11-21 at 11:19 +0100, Thomas Hummel wrote:
> Hello,
> 
> Before writing them myself, I'd like to figure out if some tools exist (anvil ?
> ...) and how to use them to extract from dovecot logs things like who is doing
> what and how hard or how fast in order to do some rate limiting. For instance,
> I'd like to be able to identify, slow or block users who
> 
>   . read or write to much / slice of time
> 
>   . login/logout too often / slice of time 
> 
> Note : I'm still using the 1.2.x branch.

The reading/writing rate limiting could be a bit tricky. I guess with
Linux you could look into /proc/<pid>/io files for all imap/pop3
processes and determine from there which processes are doing too much.

For pop3 there's also
http://dovecot.org/patches/1.2/pop3-throttle-plugin.c

Other than that, I don't know of any existing stuff for v1.2. For v2.1
there's the new "stats" service and you can ask all kinds of statistics
from it, including what users/processes have used the most disk IO.