Is there a way to split the auth logging (logins and failed logins) from the other logging that goes to info_log_path = /var/log/dovecot/dovecot.log ? This log gets a lot of other info as well, most notably the lmtp notifications about every filed mail (with no level stamping, btw). This makes it really hard to find authentication errors quickly and comfortably. It would be nice to be able to split at least the lmtp messages away. Kai
Hi, yesterday I had something similar. I would like to skip the login & logout lines from being logged. This is something I found, but did not get it working, as I had no time fiddling with the rsyslog config yet: https://serverfault.com/questions/253418/force-dovecot-not-to-log-connect-disconnect-messages <https://serverfault.com/questions/253418/force-dovecot-not-to-log-connect-disconnect-messages> -M> Am 26.09.2018 um 09:21 schrieb Kai Schaetzl <maillists at conactive.com>: > > Is there a way to split the auth logging (logins and failed logins) from > the other logging that goes to > info_log_path = /var/log/dovecot/dovecot.log > ? > This log gets a lot of other info as well, most notably the lmtp > notifications about every filed mail (with no level stamping, btw). > This makes it really hard to find authentication errors quickly and > comfortably. > It would be nice to be able to split at least the lmtp messages away. > > Kai > > >-------------- next part -------------- An HTML attachment was scrubbed... URL: <https://dovecot.org/pipermail/dovecot/attachments/20180926/516ca9e7/attachment.html>
I hoped I don't have to switch to syslog logging. Well, anyway. I changed 10-logging.conf: syslog_facility = uucp and commented out the other log lines. rsyslog.d/50-default.conf: uucp.debug -/var/log/dovecot/debug.log uucp.info -/var/log/dovecot/dovecot.log uucp.warn -/var/log/dovecot/warn.log uucp.err -/var/log/dovecot/error.log uucp.crit -/var/log/warn.log No fancy redirects with rsyslog yet, plain logging by facility and level. But it logs only to /var/log/syslog. As if dovecot sets another facility. I've used uucp in the past with success (not with rsyslog, but with syslog). AFAIK, uucp still exists as a facility in rsyslog. Shouldn't the above work? (Yes, I restarted both daemons.) Kai
For later versions of 2.3.x, it will eventually be possible to use log filtering to accomplish this entirely within Dovecot. We are not quite there yet though. michael> On September 26, 2018 at 1:21 AM Kai Schaetzl <maillists at conactive.com> wrote: > > > Is there a way to split the auth logging (logins and failed logins) from > the other logging that goes to > info_log_path = /var/log/dovecot/dovecot.log > ? > This log gets a lot of other info as well, most notably the lmtp > notifications about every filed mail (with no level stamping, btw). > This makes it really hard to find authentication errors quickly and > comfortably. > It would be nice to be able to split at least the lmtp messages away. > > Kai > > >