Force Dovecot not to log connect/disconnect messages

Question

My /var/log/mail.log gets constantly flooded with Dovecot connect/disconnect messages like this:

Mar 29 18:15:48 summit dovecot: IMAP([email protected]): Disconnected: Logged out bytes=63/2126          
Mar 29 18:15:50 summit dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=4.3.2.1, lip=1.2.3.4, TLS

These are repeated ad infinitum (to the tune of 11MB of logs per day), and they're obscuring the more important authentication failures and Postfix deliveries/receptions. I've checked Dovecot's wiki page for logging, but no option there stops these messages. Is there any configuration variable I can set within dovecot.conf to stop these messages being sent to mail.log?

Clarification: I still want Dovecot to log to mail.log; I just don't want it logging these frivolous connect/disconnect messages.

Answer 1

If you are using rsyslog or syslog-ng you can filter syslog messages. Here is an example from the rsyslog help:

with a simple statement:

:msg, contains, "imap-login" ~

or with the if-else script language:

if $programname == 'dovecot' then {
   action(type="omfile" file="/var/log/dovecot.log")
   if $msg contains 'imap-login' then
     action(type="omfile" file="/var/log/dovecot-login.log")
   else
     action(type="omfile" file="/var/log/dovecot.log")
}

http://www.rsyslog.com/doc/rsyslog_conf_filter.html

Answer 2

Enable Logging to a file with log_path and/or info_log_path then comment out syslog_facility.

or

Change the syslog_facility and control the output with /etc/syslog.conf.

:/etc/dovecot.conf

##
## Logging
##

# Log file to use for error messages, instead of sending them to syslog.
# /dev/stderr can be used to log into stderr.
#log_path = /var/log/dovecot.log

# Log file to use for informational and debug messages.
# Default is the same as log_path.
#info_log_path = /var/log/dovecot-info.log

...

# Syslog facility to use if you're logging to syslog. Usually if you don't
# want to use "mail", you'll use local0..local7. Also other standard
# facilities are supported.
syslog_facility = mail

Answer 3

The easiest way I could get rid of dovecot's login/logout messages was by creating the file 49-dovecot-ignore-info.conf under /etc/rsyslog.d with:

mail.=info       ~

This basically means to discard all info messages comming from mail facility (which dovecot uses). More info: http://manpages.ubuntu.com/manpages/hardy/man5/rsyslog.conf.5.html, under Discard section.

Then do a

sudo service dovecot restart

And the messages are no long stored in log files.

Answer 4

First remove syslog from dovecot has it's critical to have syslog clean as dovecot produce a lot of log so log it separately (rsyslog) is your friend to make your log rotate.

If you use dovecot with multi files configuration (debian) just go to 10-logging.... Don t forget to make a check with grep log *.conf on all configuration files to be sure that nothing is write two or more times. Then because your processor and your hard drive are precious just put that.

One day if you need to have informations just comment this line and log this somewhere else.

info_log_path = /dev/null

Answer 5

"connect/disconnect" messages are info messages from dovecot, so you can configure dovecot not to log the info messages:

# /etc/dovecot/conf.d/10-logging.conf
info_log_path = /dev/null

# same for debug messages
debug_log_path = /dev/null

# if you set a file path, it will log to this file and not to syslog anymore
info_log_path = /var/log/mail.log

Answer 6

How about a cron job every hour or so to remove the lines with sed something like this:

sed -e '/\(dovecot: IMAP.*Disconnected:.*\|dovecot: imap-login: Login: user\)/d' /var/log/mail.log > /var/log/mail.log

I am no master or regex or sed so please take a long hard look at this if you want to use it.