Hello Martin, thanks for the logcheck database patch, it seems to work. The only common Dovecot message i still receive, even with the updated file, is: Nov 22 13:02:35 outback dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=1.2.3.4 rip=1.2.3.4 resp=<hidden> Maybe you can add a regex for this line as well. Also I updated the file on my productive systems, so we can see if the patch worked. Regards, Stefan.