From bfa2b9dec3bb5414e8a8f46d518ec3bce2fbec1a Mon Sep 17 00:00:00 2001 From: Steven Hiscocks Date: Fri, 5 Jul 2013 18:36:02 +0100 Subject: [PATCH] ENH: dovecot filter additions for session, time value and blank user --- ChangeLog | 3 +++ config/filter.d/dovecot.conf | 2 +- testcases/files/logs/dovecot | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index dd5426a2..c91d6bcd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,6 +38,9 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released Alexander Dietrich * action.d/sendmail-common.conf -- added common sendmail settings file and made the sender display name configurable + Steven Hiscocks + * filter.d/dovecot - Addition of session, time values and possible blank + user ver. 0.8.10 (2013/06/12) - wanna-be-secure ----------- diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf index f111859f..2143e224 100644 --- a/config/filter.d/dovecot.conf +++ b/config/filter.d/dovecot.conf @@ -17,7 +17,7 @@ _daemon = dovecot(-auth)? # Values: TEXT # failregex = ^%(__prefix_line)s(pam_unix(\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=(\s+user=\S*)?\s*$ - ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \((no auth attempts|auth failed, \d+ attempts|tried to use disabled \S+ auth)\):( user=<\S+>,)?( method=\S+,)? rip=, lip=(\d{1,3}\.){3}\d{1,3}(, TLS( handshaking)?(: Disconnected)?)?\s*$ + ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot index 01df0af3..b4d978b6 100644 --- a/testcases/files/logs/dovecot +++ b/testcases/files/logs/dovecot @@ -14,3 +14,5 @@ Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected Jun 23 00:52:43 vhost1-ua dovecot: pop3-login: Disconnected: Inactivity (auth failed, 1 attempts): user=, method=PLAIN, rip=193.95.245.163, lip=176.214.13.210 +Jul 02 13:49:31 hostname dovecot[442]: pop3-login: Aborted login (auth failed, 1 attempts in 17 secs): user=, method=PLAIN, rip=192.51.100.13, lip=203.0.113.17, session= +Jul 02 13:49:32 hostname dovecot[442]: pop3-login: Disconnected (no auth attempts in 58 secs): user=<>, rip=192.51.100.13, lip=203.0.113.17, session=