Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi I would be very thankful if someone could help me on explaining this logwatch summary of my postfix installation on my ubuntu 10.04 vps. I dont really know if this might be a normal log file because of the many authentication failed entries and foreign IP addresses. Any advise for a novice? Thx!

****** Summary
113 SASL authentication failed
195 Miscellaneous warnings
8.419K Bytes accepted 8,621
8.419K Bytes delivered 8,621
======== ==================================================
3 Accepted 60.00%
2 Rejected 40.00%
-------- --------------------------------------------------
5 Total 100.00%
======== ==================================================
2 5xx Reject relay denied 100.00%
-------- --------------------------------------------------
2 Total 5xx Rejects 100.00%
======== ==================================================
116 Connections
1 Connections lost (inbound)
116 Disconnections
3 Removed from queue
3 Delivered
1 Hostname verification errors
****** Detail (10)
113 SASL authentication failed
113 generic failure
195 Miscellaneous warnings
113 SASL authentication failure: cannot connect to saslauthd server: Permission
41 inet_protocols: IPv6 support is disabled: Address family not supported by
41 inet_protocols: configuring for IPv4 support only
2 5xx Reject relay denied
1 unknown
1 Connections lost (inbound)
1 After RCPT
3 Delivered
3 myhost.xx
1 Hostname verification errors
1 Name or service not known
=== Delivery Delays Percentiles
0% 25% 50% 75% 90% 95% 98% 100%
share|improve this question

closed as not a real question by mgorven, EightBitTony, rnxrx, John Gardeniers, Scott Pack Oct 20 '12 at 19:16

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

The 113 authentication errors match up with the 113 SASL errors.

SASL authentication failure: cannot connect to saslauthd server: Permission denied

There seem to be many different reasons that can cause this error message. See if any of those fix your SASL problem.

Is that IP address you? If not, someone may be trying out passwords to see if they can log in.

share|improve this answer
Hi thx for your reply! is not my ip address! I am just concerned that my postfix server is being used as a spam emailer. – DannyRe Jul 2 '12 at 14:43
With 3 Delivered in that report, your server is not a major spam source if it is sending any. Check the actual logs to be sure. Large changes in that number tend to be an indication that someone has figured out how to use your server to send spam. Once they get in, they will send tens of thousands per day. You can test to see if you are running an open relay here. – Ladadadada Jul 2 '12 at 14:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.