<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Jeff,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks again for your insights. I understand that a lot of features are pending and it's totally fine, we're just very eager to use all these features.
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Reagarding the logging of failed attempts I did try to configure this in these two metrics:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<pre style="background-color:#2b2b2b; color:#a9b7c6; font-family:'JetBrains Mono',monospace; font-size:9.8pt">metric auth_client_userdb_lookup_finished {<br> event_name = auth_client_userdb_lookup_finished<br> group_by = service local_ip remote_ip user<br>}<br></pre>
<pre style="background-color:#2b2b2b; color:#a9b7c6; font-family:'JetBrains Mono',monospace; font-size:9.8pt">metric auth_client_passdb_lookup_finished {<br> event_name = auth_client_passdb_lookup_finished<br> group_by = service local_ip remote_ip user<br>}<br></pre>
In both our testing and production environment these are not increasing and stay at 0:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
$ sudo curl 0:9166/metrics -s | grep -E 'dovecot_auth_client_(user|pass)db_lookup_finished'
<div># HELP dovecot_auth_client_userdb_lookup_finished_count Total number</div>
<div># TYPE dovecot_auth_client_userdb_lookup_finished_count counter</div>
<div>dovecot_auth_client_userdb_lookup_finished_count 0 1598493762018</div>
<div># HELP dovecot_auth_client_userdb_lookup_finished_duration_usecs_sum Duration</div>
<div># TYPE dovecot_auth_client_userdb_lookup_finished_duration_usecs_sum counter</div>
<div>dovecot_auth_client_userdb_lookup_finished_duration_usecs_sum 0 1598493762018</div>
<div># HELP dovecot_auth_client_passdb_lookup_finished_count Total number</div>
<div># TYPE dovecot_auth_client_passdb_lookup_finished_count counter</div>
<div>dovecot_auth_client_passdb_lookup_finished_count 0 1598493762018</div>
<div># HELP dovecot_auth_client_passdb_lookup_finished_duration_usecs_sum Duration</div>
<div># TYPE dovecot_auth_client_passdb_lookup_finished_duration_usecs_sum counter</div>
<div>dovecot_auth_client_passdb_lookup_finished_duration_usecs_sum 0 1598493762018</div>
<br>
I will try to gather some more information and post it later. Let me know if you think there might be something up with the way we configure them.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Daan<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Josef 'Jeff' Sipek <jeff.sipek@open-xchange.com><br>
<b>Sent:</b> 26 August 2020 23:02<br>
<b>To:</b> Daan van Gorkum <daan.vangorkum@vusam.com><br>
<b>Cc:</b> Dovecot Mailing List <dovecot@dovecot.org><br>
<b>Subject:</b> Re: Metric label values truncated when using OpenMetrics endpoint</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On Tue, Aug 25, 2020 at 01:08:06 +0000, Daan van Gorkum wrote:<br>
> Hi Jeff,<br>
> <br>
> Thanks for your reply!<br>
> <br>
> Regarding grouping by remote address, I understand and for now I'll keep a<br>
> close eye. Maybe it's an option to group by /24 for ipv4 and /64 for IPv6?<br>
<br>
Hrm, interesting idea. But the answer is: no, there isn't a way. The<br>
simplest way to implement something like this would be to add a new<br>
aggregating function. So one could do something like:<br>
<br>
remote_ip:netmask4:24<br>
remote_ip:netmask6:64<br>
<br>
To get /24 and /64, respectively.<br>
<br>
I'll throw this idea on the ever growing pile of things that can be worked<br>
on :) Obviously, I can't make any promisses about this ever getting done.<br>
<br>
> We currently do that based on the logs but the OpenMetrics endpoint seem a<br>
> lot easier.<br>
<br>
Aggregating based on a subnet definitely makes sense.<br>
<br>
> A slight hijack of the original question: but I tried to log only IP<br>
> addresses (+ result) of failed login attempts but it seems I cannot find a<br>
> metric that would contain that information. Am I looking in the wrong<br>
> direction? The auth_userdb_request_finished and<br>
> auth_passdb_request_finished stats work as intended but they do not<br>
> contain any information about the connecting client.<br>
<br>
I haven't played with these events, but at least based on the docs [1],<br>
auth_client_userdb_lookup_finished and auth_client_passdb_lookup_finished<br>
events seem to have the remote_ip field as well as an error string on<br>
failure. Does that give you the info you need?<br>
<br>
Jeff.<br>
<br>
[1] <a href="https://doc.dovecot.org/admin_manual/list_of_events/">https://doc.dovecot.org/admin_manual/list_of_events/</a><br>
</div>
</span></font></div>
</body>
</html>