| View previous topic :: View next topic |
| Author |
Message |
tam
Guru
Joined: 04 Mar 2003
Posts: 569
|
 Posted: Mon May 10, 2004 11:27 am Post subject: metalog and courier-imapd |
 |
|
Hi!
I want to log all imapd msgs into /var/log/imap, but all imap msgs go into /var/log/mail
Anyone can help?
| Code: |
root@serv4 /etc/metalog # root@serv4 /etc/metalog # cat met*
# $Header: /home/cvsroot/gentoo-x86/app-admin/metalog/files/metalog.conf,v 1.3 2003/10/17 02:47:53 pebenito Exp $
#
# Sample Metalog configuration file
maxsize = 500000
# maxtime = 86400
maxfiles = 5
Kernel messages :
facility = "kern"
logdir = "/var/log/kernel"
Crond :
facility = "cron"
logdir = "/var/log/crond"
Dudes firewalled by IPTrap :
program = "iptrap"
logdir = "/var/log/iptrap"
Password failures :
regex = "(password|login|authentication)\s+(fail|invalid)"
regex = "(failed|invalid)\s+(password|login|authentication)"
regex = "ILLEGAL ROOT LOGIN"
logdir = "/var/log/pwdfail"
# command = "/usr/local/sbin/mail_pwd_failures.sh"
FTP Server :
facility = "*"
program = "pure-ftpd"
logdir = "/var/log/ftpd"
SSH Server :
facility = "*"
program = "sshd"
logdir = "/var/log/sshd"
Telnet :
facility = "*"
program = "login"
logdir = "/var/log/telnet"
#Add authenticated IP addresses for SMTP relaying :
# program = "/usr/sbin/ipop3d"
# regex = "Login.+nmsgs="
# command = "/usr/local/sbin/add_pop_address.sh"
Mail :
facility = "mail"
logdir = "/var/log/mail"
Imap :
facility = "*"
program = "courier-imapd"
logdir = "/var/log/imap"
Everything important :
facility = "*"
minimum = 6
logdir = "/var/log/everything"
Everything very important :
facility = "*"
minimum = 1
logdir = "/var/log/critical"
#
#Uncomment and adjust the following lines to
#your needs to enable console logging
#
# Hint: you can change the device to which
# should be logged in /usr/sbin/consolelog.sh
#
#console logging :
#
# facility = "*"
# command = "/usr/sbin/consolelog.sh"
#dhcp :
# program = "/usr/sbin/dhcpd"
# logdir = "/var/log/dhcp"
dhcp:
facility = "*"
program = "dhcpd"
logdir = "/var/log/dhcpd"
named (bind) :
facility = "*"
program = "named"
logdir = "/var/log/named"
root@serv4 /etc/metalog #
|
|
|
| Back to top |
|
 |
Hayl
Guru
Joined: 28 Jan 2003
Posts: 442
Location: Calgary, Alberta, Canada
|
| Posted: Mon May 10, 2004 6:37 pm Post subject: |
|
|
This works for me.
| Code: | # $Header: /home/cvsroot/gentoo-x86/app-admin/metalog/files/metalog.conf,v 1.3 2003/10/17 02:47:53 pebenito Exp $
#
# Sample Metalog configuration file
maxsize = 100000
maxtime = 86400
maxfiles = 5
Kernel messages :
facility = "kern"
logdir = "/var/log/kernel"
Crond :
facility = "cron"
logdir = "/var/log/crond"
Dudes firewalled by IPTrap :
program = "iptrap"
logdir = "/var/log/iptrap"
Password failures :
regex = "(password|login|authentication)\s+(fail|invalid)"
regex = "(failed|invalid)\s+(password|login|authentication)"
regex = "ILLEGAL ROOT LOGIN"
logdir = "/var/log/pwdfail"
# command = "/usr/local/sbin/mail_pwd_failures.sh"
FTP Server :
program = "pure-ftpd"
logdir = "/var/log/ftpd"
SSH Server :
program = "sshd"
logdir = "/var/log/sshd"
Telnet :
program = "login"
logdir = "/var/log/telnet"
Imap :
program = "imapd"
logdir = "/var/log/imap"
POP Toaster :
program = "/usr/sbin/ipop3d"
logdir = "/var/log/pop"
#Add authenticated IP addresses for SMTP relaying :
# program = "/usr/sbin/ipop3d"
# regex = "Login.+nmsgs="
# command = "/usr/local/sbin/add_pop_address.sh"
Mail :
facility = "mail"
logdir = "/var/log/mail"
Everything important :
facility = "*"
minimum = 6
logdir = "/var/log/everything"
Everything very important :
facility = "*"
minimum = 1
logdir = "/var/log/critical"
#
#Uncomment and adjust the following lines to
#your needs to enable console logging
#
# Hint: you can change the device to which
# should be logged in /usr/sbin/consolelog.sh
#
#console logging :
#
# facility = "*"
# command = "/usr/sbin/consolelog.sh" |
|
|
| Back to top |
|
|
tam
Guru
Joined: 04 Mar 2003
Posts: 569
|
| Posted: Tue May 11, 2004 6:55 am Post subject: |
|
|
| Code: |
Imap :
program = "imapd"
logdir = "/var/log/imap"
|
Thanks. Works for me, too 
Is it possible to remove the imapd logs from /var/log/mail now? Currently imapd is loged in /var/log/mail and /var/log/imap |
|
| Back to top |
|
|
|
Networking & Security
