logwatch courier-imapの設定

□ /etc/log.d/conf/services/pop3.conf
*** pop3.conf.org 2004-12-11 21:06:38.387999734 +0900
--- pop3.conf 2004-12-11 21:07:24.868212904 +0900
***************
*** 15,21 ****
Title = "POP-3"

# Which logfile group...
! LogFile = messages

# Only give lines pertaining to courier...
# I'm not sure if this is complete, especially for the new webmail daemon in 0.44.1
--- 15,21 ----
Title = "POP-3"

# Which logfile group...
! LogFile = maillog

# Only give lines pertaining to courier...
# I'm not sure if this is complete, especially for the new webmail daemon in 0.44.1

□ /etc/log.d/scripts/services/pop3
*** pop3.org 2004-12-11 21:11:16.856247486 +0900
--- pop3 2004-12-11 12:20:41.000000000 +0900
***************
*** 19,31 ****
sub LookupIPv46 {
my $IPv4Addr;
my $Addr = $_[0];
if ( ($IPv4Addr) = ($Addr =~ /::ffff:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})/ ) ) {
! # print "$IPv4Addr\n";
return $IPv4Addr;

}
else {
! # print $Addr;
return $Addr;

}
--- 19,32 ----
sub LookupIPv46 {
my $IPv4Addr;
my $Addr = $_[0];
+ #print "DEBUG:LookupIPv46($Addr)\n" ;
if ( ($IPv4Addr) = ($Addr =~ /::ffff:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})/ ) ) {
! # print "DEBUG:64:$IPv4Addr\n";
return $IPv4Addr;

}
else {
! # print "DEBUG:44:$Addr\n";
return $Addr;

}
***************
*** 54,63 ****
--- 55,75 ----
($ThisLine =~ /^spgetpwnam: can't find user: */) or
($ThisLine =~ /^sptls: SSL_accept error: (-|)\d+$/) or
($ThisLine =~ /^sptls: do need at least RSA or DSA cert\/key data$/)
+ # ---------------------------------------------------------------------------------
+ or
+ ($ThisLine =~ /^Connection, ip=/) or
+ ($ThisLine =~ /^Unexpected SSL connection shutdown.$/) or
+ ($ThisLine =~ /^couriertls: read: Connection reset by peer$/) or
+ ($ThisLine =~ /^LOGOUT, /)
+ # ---------------------------------------------------------------------------------
) {
# Don't care about these...
} elsif ( ($User, $Host) = ( $ThisLine =~ /^user (.*?) authenticated - (.*)$/ ) ) {
$Login{$User}{$Host}++;
+ # ---------------------------------------------------------------------------------
+ } elsif ( ($User, $Host) = ( $ThisLine =~ /^LOGIN, user=(.*?), ip=\[(.*)\]$/ ) ) {
+ $Login{$User}{$Host}++;
+ # ---------------------------------------------------------------------------------
} elsif ( ($User,$Downloaded,$DownloadSize,$Left,$LeftSize) = ( $ThisLine =~ /^Stats: (.*?) (.*?) (.*?) (.*?) (.*?)$/) ) {
$DownloadedMessages{$User} += $Downloaded;
$DownloadedMessagesSize{$User} += $DownloadSize;
***************
*** 72,77 ****
--- 84,94 ----
$Connection{$Host}++;
} elsif ( ($User,$Host) = ( $ThisLine =~ /^authentication failed for user (.*?) - (.*)/ ) ) {
$LoginFailed{"$Host ($User)"}++;
+ # ---------------------------------------------------------------------------------
+ } elsif ( ($Host) = ( $ThisLine =~ /^LOGIN FAILED, ip=\[(.+)\]/ ) ) {
+ $Host=&LookupIPv46($Host) ;
+ $LoginFailed{"$Host (User)"}++;
+ # ---------------------------------------------------------------------------------
} elsif ( ($User,$Host) = ( $ThisLine =~ /^authentication failed: no such user: (.*?) - (.*)/ ) ) {
$LoginFailed{"$Host (UNKNOWN: $User)"}++;
} elsif ( ($Mechanism) = ( $ThisLine =~ /^sptls: TLS connection established: (.*)$/ ) ) {

□ /etc/log.d/scripts/services/imapd
*** imapd.org 2004-12-11 21:11:08.005740742 +0900
--- imapd 2004-12-11 12:21:42.000000000 +0900
***************
*** 39,44 ****
--- 39,52 ----
if (
($ThisLine =~ /^Initializing */) or
($ThisLine =~ /^spgetpwnam: can't find user: */)
+ # -------------------------------------------------------------------------------
+ or
+ ($ThisLine =~ /^Connection, ip=/) or
+ ($ThisLine =~ /^LOGOUT, user=/) or
+ ($ThisLine =~ /^Unexpected SSL connection shutdown.$/) or
+ ($ThisLine =~ /^couriertls: read: Connection reset by peer$/) or
+ ($ThisLine =~ /^DISCONNECTED, user=/)
+ # -------------------------------------------------------------------------------
) {
# Don't care about these...
} elsif ( ($User, $Host) = ( $ThisLine =~ /^Login user=(.*?) host=(.* \[.*\])$/ ) ) {
***************
*** 47,52 ****
--- 55,64 ----
$Login{$User}{$Host}++;
} elsif ( ($User,$Host) = ( $ThisLine =~ /^Preauthenticated user=(.*) host=(.*)$/ ) ) {
$Login{$User}{$Host}++;
+ # -------------------------------------------------------------------------------
+ } elsif ( ($User,$Host) = ( $ThisLine =~ /^LOGIN, user=(.*?), ip=\[([^\]]+)\],/ ) ) {
+ $Login{$User}{$Host}++;
+ # -------------------------------------------------------------------------------
} elsif ( ($Host) = ( $ThisLine =~ /^imap service init from (.*)$/ ) ) {
$ConnectionNonSSL{$Host}++;
$Connection{$Host}++;
***************
*** 199,205 ****


if ( ( $Detail >= 10 ) and (keys %Login)) {
! print "\n[POP3] Successful Logins:\n";
$LoginCount = 0;
foreach my $User (keys %Login) {
print " User $User: \n";
--- 211,220 ----


if ( ( $Detail >= 10 ) and (keys %Login)) {
! # --------------------------------------------------
! #print "\n[POP3] Successful Logins:\n";
! # --------------------------------------------------
! print "\n[IMAPd] Successful Logins:\n";
$LoginCount = 0;
foreach my $User (keys %Login) {
print " User $User: \n";