-1

My Dovecot mail server and Postfix MTA seems to be generating logs about attempts to login from localhost. How could I investigate this issue?

Log excerpt:

Jun  8 09:36:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun  8 09:36:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun  8 09:37:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:37:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:37:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun  8 09:37:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun  8 09:38:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:38:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:38:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun  8 09:38:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun  8 09:39:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:39:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:39:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun  8 09:39:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun  8 09:40:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:40:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun  8 09:40:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Ernestas
  • 23
  • 6

1 Answers1

0

It seems that Zabbix was monitoring these services every minute and hence generating lots of log material.

Ernestas
  • 23
  • 6