dovecot - Jun 2021 - Dovecot Stats for Logwatch

Well I didn't really find what I was looking for around the web, so I just
sat down and hacked out an attempt in bash which gives me a starting point. I
guess I'll add things when I need them and fix things when it breaks.

Its here if anyone can use it. Any suggestions for improvement welcome. Use at
your own risk etc.

https://gist.github.com/plutocrat/8a2033923e14670dd13611fc0b51fc0f

To add to logwatch you
  - put it in the scripts dir as eg
/etc/logwatch/scripts/services/dovecot_summary
  - add a config file in /etc/logwatch/conf/services/dovecot_summary.conf
  - Add a line in /etc/logwatch/conf/logwatch.conf like "Service =
dovecot_summary"

P.
>> I run logwatch on a few servers and the script on there which parses
the dovecot logs provides waaaaaay too much detail, and contains a bunch of
stuff I'm not interested in. There's not much point in having a log
summary if its 100Kb long! The one for exim is also terrible, but I've
replaced that with eximstats, and a bit of bash scripting and have something I
can work with. I might at some point look at replacing that too>> Now to
my question. I haven't found anything in the dovecot family which compares
to eximstats. I was wondering if there possibly is a report tool, or a way of
extracting stats from doveadm just for key metrics such as 'number of POP
logins in the last 24 hours', number of failed passwords, etc. Things that
might be interesting on a logwatch report. Or maybe someone has written a script
already that can  be used in logwatch in perl, python, bash, whatever. Any
pointers, suggestions, or ideas for useful summary metrics to pull out of the
logfiles are appreciated.
>>
>> I suspect I might end up writing one myself anyway, but I'm just
keen to see what already exists, get the benefit of anyone else's
experiences in this matter before I start.

On 02 Jun 2021, at 02:10, Plutocrat <plutocrat at gmail.com>
wrote:
> Its here if anyone can use it. Any suggestions for improvement welcome. Use
at your own risk etc.
> 
> https://gist.github.com/plutocrat/8a2033923e14670dd13611fc0b51fc0f
This looks good. My only comment is the script doesn't account for
compressed logs.

LOG1="/var/log/dovecot.log.0.bz2"
LOG2="/var/log/dovecot.log"
bzcat $LOG1 | sed "0,/^$STARTTIME/d" > $TEMPFILE
cat $LOG2 >> $TEMPFILE 

Well, another comment, I think you meant these tow lines to read like this:

STARTDATE=$(head -n 1 $TEMPFILE | awk '{print $1 " " $2 "
" $3 }')
ENDDATE=$(tail -n 1 $TEMPFILE | awk '{print $1 " " $2 "
" $3 }')

Though I don't think the awk is necessary, the first 15 characters of the
first and last lines contain the info you want to display.

Of course, it would begetter to handle this all transparently, but ? meh.

-- 
"Are you pondering what I'm pondering?"
"I think so, Brain! But do I have what it take to be the 'Lord of the
	Dance'?"