LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 11-22-2006, 02:31 AM   #1
collen
Member
 
Registered: Jun 2003
Location: /
Distribution: Fedora/Debian
Posts: 86

Rep: Reputation: 15
Logwatch unmatched entries courier mail


Hello...

i have a lot of unmatched entries from courier mail in my logwatch output.
but nothing goes wrong ?! (with imap that is)
i use Debian Sarge, with Logwatch 7.3.1 (09/15/06)
all standard debian pakages.
the rest works fine....

--------------------- courier mail services Begin ------------------------

**Unmatched Entries**
couriertcpd - 1328 Times
DISCONNECTED, user=info.mlhj, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=603, sent=1877, time=1973 - 1 Time
DISCONNECTED, user=info.mlhj, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=7713, sent=4619, time=10700 - 1 Time
DISCONNECTED, user=info.mlhj, ip=[::ffff:127.0.0.1], headers=1116, body=454636, rcvd=482556, sent=467603, time=1993 - 1 Time
DISCONNECTED, user=info.mlhj, ip=[::ffff:127.0.0.1], headers=2436, body=32787, rcvd=3926, sent=48209, time=10408 - 1 Time

AND

LOGOUT, user=ict.mlhj, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=344, sent=2468, time=468 - 1 Time
LOGOUT, user=ict.mlhj, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=368, sent=1223, time=1627 - 1 Time
LOGOUT, user=ict.mlhj, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=55717, sent=2781, time=9146 - 1 Time
LOGOUT, user=ict.mlhj, ip=[::ffff:127.0.0.1], headers=0, body=0, rcvd=593, sent=3039, time=1627 - 1 Time

and

LOGIN, user=ict.mlhj, ip=[::ffff:127.0.0.1], protocol=IMAP - 30 Times
LOGIN, user=info.mlhj, ip=[::ffff:127.0.0.1], protocol=IMAP - 19 Times
-----------
 
Old 11-22-2006, 05:47 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592
Insert ignore filters into your your log.d/scripts/services/courier where it starts processing input:
Code:
while (defined($ThisLine = <STDIN>)) {
   my $Size2 = 0;
   my $Size  = 0;
   if (
      ($ThisLine =~ /^Initializing */) or
      ($ThisLine =~ /^DISCONNECTED, */) or
      ($ThisLine =~ /^LOGOUT, */) or
 
Old 11-22-2006, 06:10 AM   #3
collen
Member
 
Registered: Jun 2003
Location: /
Distribution: Fedora/Debian
Posts: 86

Original Poster
Rep: Reputation: 15
But i would like to get proper reports on courier imap.
isn't that code ignoring all that importand stuff ?!
 
Old 11-22-2006, 10:07 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592Reputation: 3592
isn't that code ignoring all that importand stuff ?!
No, but you're free to experiment with it. The only alternatives I can see are lowering Logwatch debug level (but that's not finegrained and affects all log output) or tacking on a postprocess filter (which is inefficient if you can do it within Logwatch).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Have Logwatch mail attachments stefaandk Linux - Newbie 4 09-05-2013 11:23 AM
Changes to logwatch stopped root mail! blackdragonblood Linux - General 5 01-19-2006 10:53 PM
LogWatch Cron :: Unmatched Entries elvisious Linux - Software 2 06-23-2004 07:10 AM
Strange problem (Unmatched Entries) 2HostMe Linux - Newbie 2 01-10-2004 08:32 AM
Interpreting mail sent by logwatch JasonW Linux - General 0 02-20-2003 06:17 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 12:29 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration