Is there a way to get info on the source of authentication failures (SASL, IMAP/POP3 mailbox access) and at the same time the username from Dovecot logs? I have a 2.2.4 installation (+ Postfix), with "auth_verbose" switched on in the main section, authentication through SQL, and I get lines like the following after unsuccesful authentication:
Aug 1 14:00:27 mx1 dovecot: auth-worker(18980): sql(user1@domain1,126.96.36.199): unknown user Aug 1 14:00:53 mx1 dovecot: auth-worker(18980): sql(user2@domain2,188.8.131.52): Password mismatch
depending on whether the user doesn't exist in the database, or the password was not correct. In the case of POP3/IMAP mailbox access, after one/three such lines I get lines like these:
Aug 1 13:56:14 mx1 dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<user1@domain1>, method=PLAIN, rip=184.108.40.206, lip=220.127.116.11, session=<fy6Kh+HirgBN/uIC> Aug 1 13:57:51 mx1 dovecot: imap-login: Aborted login (auth failed, 3 attempts in 14 secs): user=<user2@domain2>, method=PLAIN, rip=18.104.22.168, lip=22.214.171.124, session=<xzxhjOHi3AFVTUWA>
From this I can create e.g. a daily report on users failing to authenticate their access to mailboxes, together with usernames, remote IPs, and protocol used, in order to e.g. spot client config problems, or dictionary attacks etc.
However, for SASL (outgoing mail) I only get lines like in the example 1. above. Without a wider analysis (checking whether a line like in 2. follows) I cannot know whether the line is a failure to authenticate via SASL for sending mail, or for IMAP/POP3 mailbox access. I could try to extract this information from Postfix logs, but they don't contain the username. Is there a way to make Dovecot write a line to log that would look like the lines in example 2, but for SASL/outgoing mail?