From 864d2f41b9913f0691ecc070a9e7d69a834822e5 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 9 Oct 2013 14:52:17 +1100 Subject: [PATCH] ENH: auth-worker as per of _daemon definition for dovecot --- config/filter.d/dovecot.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf index a46c3fa9..d337e6bd 100644 --- a/config/filter.d/dovecot.conf +++ b/config/filter.d/dovecot.conf @@ -9,6 +9,7 @@ before = common.conf [Definition] +_daemon = (dovecot(-auth)?|auth-worker) # Option: failregex # Notes.: regex to match the password failures messages in the logfile. # first regex is essentially a copy of pam-generic.conf @@ -16,7 +17,7 @@ before = common.conf # failregex = ^%(__prefix_line)s(pam_unix(\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=(\s+user=\S*)?\s*$ ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$ - ^%(__prefix_line)s(dovecot: )?auth(-worker)?\(\S+\): (Info: )?pam\(\S+,\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$ + ^%(__prefix_line)s(Info|dovecot: auth\(default\)): pam\(\S+,\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored.