dovecot - Nov 2011 - Dovecot Log analysis

Hello,

Before writing them myself, I'd like to figure out if some tools exist
(anvil ?
...) and how to use them to extract from dovecot logs things like who is doing
what and how hard or how fast in order to do some rate limiting. For instance,
I'd like to be able to identify, slow or block users who

  . read or write to much / slice of time

  . login/logout too often / slice of time 

Note : I'm still using the 1.2.x branch.

Thanks

-- 
Thomas Hummel 	    | Institut Pasteur
<hummel at pasteur.fr> | Groupe Exploitation et Infrastructure

On Mon, 2011-11-21 at 11:19 +0100, Thomas Hummel wrote:
> Hello,
> 
> Before writing them myself, I'd like to figure out if some tools exist
(anvil ?
> ...) and how to use them to extract from dovecot logs things like who is
doing
> what and how hard or how fast in order to do some rate limiting. For
instance,
> I'd like to be able to identify, slow or block users who
> 
>   . read or write to much / slice of time
> 
>   . login/logout too often / slice of time 
> 
> Note : I'm still using the 1.2.x branch.
The reading/writing rate limiting could be a bit tricky. I guess with
Linux you could look into /proc/<pid>/io files for all imap/pop3
processes and determine from there which processes are doing too much.

For pop3 there's also
http://dovecot.org/patches/1.2/pop3-throttle-plugin.c

Other than that, I don't know of any existing stuff for v1.2. For v2.1
there's the new "stats" service and you can ask all kinds of
statistics
from it, including what users/processes have used the most disk IO.