Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My /var/log/mail.log gets constantly flooded with Dovecot connect/disconnect messages like this:

Mar 29 18:15:48 summit dovecot: IMAP(foo@bar.baz): Disconnected: Logged out bytes=63/2126          
Mar 29 18:15:50 summit dovecot: imap-login: Login: user=<baz@bar.foo>, method=PLAIN, rip=4.3.2.1, lip=1.2.3.4, TLS

These are repeated ad infinitum (to the tune of 11MB of logs per day), and they're obscuring the more important authentication failures and Postfix deliveries/receptions. I've checked Dovecot's wiki page for logging, but no option there stops these messages. Is there any configuration variable I can set within dovecot.conf to stop these messages being sent to mail.log?

Clarification: I still want Dovecot to log to mail.log; I just don't want it logging these frivolous connect/disconnect messages.

share|improve this question

4 Answers 4

up vote 1 down vote accepted

If you are using rsyslog or syslog-ng you can filter syslog messages. Here is an example from the rsyslog help:

with a simple statement:

:msg, contains, "imap-login" ~

or with the if-else script language:

if $programname == 'dovecot' then {
   action(type="omfile" file="/var/log/dovecot.log")
   if $msg contains 'imap-login' then
     action(type="omfile" file="/var/log/dovecot-login.log")
   else
     action(type="omfile" file="/var/log/dovecot.log")
}

http://www.rsyslog.com/doc/rsyslog_conf_filter.html

share|improve this answer

Enable Logging to a file with log_path and/or info_log_path then comment out syslog_facility.

or

Change the syslog_facility and control the output with /etc/syslog.conf.

:/etc/dovecot.conf

##
## Logging
##

# Log file to use for error messages, instead of sending them to syslog.
# /dev/stderr can be used to log into stderr.
#log_path = /var/log/dovecot.log

# Log file to use for informational and debug messages.
# Default is the same as log_path.
#info_log_path = /var/log/dovecot-info.log

...

# Syslog facility to use if you're logging to syslog. Usually if you don't
# want to use "mail", you'll use local0..local7. Also other standard
# facilities are supported.
syslog_facility = mail

share|improve this answer
    
I think I may have not been clear enough in my question. I still want Dovecot to log to mail.log, but I don't want it to display these frivolous imap-login messages. Thanks for your help though! –  squircle Mar 30 '11 at 0:51

The easiest way I could get rid of dovecot's login/logout messages was by creating the file 49-dovecot-ignore-info.conf under /etc/rsyslog.d with:

mail.=info       ~

This basically means to discard all info messages comming from mail facility (which dovecot uses). More info: http://manpages.ubuntu.com/manpages/hardy/man5/rsyslog.conf.5.html, under Discard section.

Then do a

sudo service dovecot restart

And the messages are no long stored in log files.

share|improve this answer
    
I don't agree with this solution because it trashes all mail.info messages, most of which are important (like those coming from $mta (postfix in my case)). –  squircle Dec 25 '12 at 18:32

How about a cron job every hour or so to remove the lines with sed something like this:

sed -e '/\(dovecot: IMAP.*Disconnected:.*\|dovecot: imap-login: Login: user\)/d' /var/log/mail.log > /var/log/mail.log

I am no master or regex or sed so please take a long hard look at this if you want to use it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.