7

My /var/log/mail.log gets constantly flooded with Dovecot connect/disconnect messages like this:

Mar 29 18:15:48 summit dovecot: IMAP(foo@bar.baz): Disconnected: Logged out bytes=63/2126          
Mar 29 18:15:50 summit dovecot: imap-login: Login: user=<baz@bar.foo>, method=PLAIN, rip=4.3.2.1, lip=1.2.3.4, TLS

These are repeated ad infinitum (to the tune of 11MB of logs per day), and they're obscuring the more important authentication failures and Postfix deliveries/receptions. I've checked Dovecot's wiki page for logging, but no option there stops these messages. Is there any configuration variable I can set within dovecot.conf to stop these messages being sent to mail.log?

Clarification: I still want Dovecot to log to mail.log; I just don't want it logging these frivolous connect/disconnect messages.

squircle
  • 524
  • 6
  • 14
  • I know this is old but may help others. The connect/disconnect info's are not frivolous - they are info - block as needed. Also, if you are letting your user(s) connect using a 'webmail' type system, they normally have a frontend option. Default can be a 'check' once per minute. Whereas a proper email client like Thunderbird does not - just when mail arrives or operation from enduser/client is executed. – B. Shea Mar 01 '16 at 22:35
  • ..u *may* get a login if not connected.. – B. Shea Mar 01 '16 at 22:52

5 Answers5

6

If you are using rsyslog or syslog-ng you can filter syslog messages. Here is an example from the rsyslog help:

with a simple statement:

:msg, contains, "imap-login" ~

or with the if-else script language:

if $programname == 'dovecot' then {
   action(type="omfile" file="/var/log/dovecot.log")
   if $msg contains 'imap-login' then
     action(type="omfile" file="/var/log/dovecot-login.log")
   else
     action(type="omfile" file="/var/log/dovecot.log")
}

http://www.rsyslog.com/doc/rsyslog_conf_filter.html

Jure1873
  • 3,702
  • 1
  • 22
  • 28
0

Enable Logging to a file with log_path and/or info_log_path then comment out syslog_facility.

or

Change the syslog_facility and control the output with /etc/syslog.conf.

:/etc/dovecot.conf

##
## Logging
##

# Log file to use for error messages, instead of sending them to syslog.
# /dev/stderr can be used to log into stderr.
#log_path = /var/log/dovecot.log

# Log file to use for informational and debug messages.
# Default is the same as log_path.
#info_log_path = /var/log/dovecot-info.log

...

# Syslog facility to use if you're logging to syslog. Usually if you don't
# want to use "mail", you'll use local0..local7. Also other standard
# facilities are supported.
syslog_facility = mail
wrmine
  • 267
  • 1
  • 4
  • I think I may have not been clear enough in my question. I still want Dovecot to log to `mail.log`, but I **don't** want it to display these frivolous `imap-login` messages. Thanks for your help though! – squircle Mar 30 '11 at 00:51
0

The easiest way I could get rid of dovecot's login/logout messages was by creating the file 49-dovecot-ignore-info.conf under /etc/rsyslog.d with:

mail.=info       ~

This basically means to discard all info messages comming from mail facility (which dovecot uses). More info: http://manpages.ubuntu.com/manpages/hardy/man5/rsyslog.conf.5.html, under Discard section.

Then do a

sudo service dovecot restart

And the messages are no long stored in log files.

Luis Felipe Marzagao
  • 9
  • 1
  • I don't agree with this solution because it trashes *all* mail.info messages, most of which are important (like those coming from `$mta` (postfix in my case)). – squircle Dec 25 '12 at 18:32
-1

How about a cron job every hour or so to remove the lines with sed something like this:

sed -e '/\(dovecot: IMAP.*Disconnected:.*\|dovecot: imap-login: Login: user\)/d' /var/log/mail.log > /var/log/mail.log

I am no master or regex or sed so please take a long hard look at this if you want to use it.

squareborg
  • 592
  • 3
  • 14
-1

First remove syslog from dovecot has it's critical to have syslog clean as dovecot produce a lot of log so log it separately (rsyslog) is your friend to make your log rotate.

If you use dovecot with multi files configuration (debian) just go to 10-logging.... Don t forget to make a check with grep log *.conf on all configuration files to be sure that nothing is write two or more times. Then because your processor and your hard drive are precious just put that.

One day if you need to have informations just comment this line and log this somewhere else.

info_log_path = /dev/null

izulh
  • 1