Unmatched dovecot lines in logwatch

[John Stark]

Getting the following lines in logwatch, ho wcan i get rid of them? There are hundreds of each, so collapsing to one line would be nice too. Background is a local webmailer accessing dovecot per imap on localhost. ABC and XYZ are placeholders for the real adresses

System: Ubuntu 10.04.4 LTS

dovecot-common: 1:1.2.9-1ubuntu6.5

logwatch: 7.3.6.cvs20090906-1ubuntu2.1

Script: dovecot,v 1.17 2009/06/02 14:48:06 mike

These lines appear several hundred times:

    dovecot: auth(default): client in:
AUTH^I1^IPLAIN^Iservice=imap^Isecured^Ilip=127.0.0.1^Irip=127.0.0.1^Ilport=143^Irport=46863^Iresp=<hidden>:
1 Time(s)

    dovecot: auth(default): master in: REQUEST^I3374^I32082^I1: 1 Time(s)

    dovecot: auth(default): master out:
USER^I3372^<email address hidden>^Iuid=5000^Igid=5000^Ihome=/home/vmail/XYZ.COM/ABC:
1 Time(s)

    dovecot: auth(default): new auth connection: pid=11423: 1 Time(s)

These seem to get collapsed fine:

    dovecot: auth(default): client out: OK^I1^<email address hidden>: 839 Time(s)

    dovecot: auth(default): passwd(<email address hidden>,127.0.0.1): lookup: 839 Time(s)

    dovecot: auth(default): passwd(<email address hidden>,127.0.0.1): unknown user: 839
Time(s)

    dovecot: auth(default): passwd-file(<email address hidden>,127.0.0.1): lookup:
<email address hidden> file=/etc/dovecot/passwd: 839 Time(s)

Any help is welcome!

[Robie Basak (racb)]

Thank you for taking the time to report this bug and helping to make Ubuntu better.

It isn't clear if logwatch is supposed to parse dovecot log entries already and is getting it wrong, if you're reporting a Wishlist bug to have this feature added, or if you're just looking for local configuration help with logwatch.

Please could you clarify? If you want help configuring logwatch, then this bug tracker isn't the appropriate place; please see http://www.ubuntu.com/support/community for pointers and change the bug status to Invalid. Otherwise, please explain and change the bug status back to New. Thanks!

[John Stark (hamees)]

Yes, there is a dovecot script in the logwatch directory, which is partially parsing the dovecot log lines. Unfortunatelly it doesn't seem to understand the lines I have posted. I am not sure why this is happening, but I have installed both dovecot and logwatch per apt-get, so it should not cause such problems.

[John Stark (hamees)]

Setting "Detail = Low" in /etc/logwatch/conf/logwatch.conf removed most of the lines.
I'm not sure what the default level is after installation, so sorry if this was a self-produced bug.
Maybe it's still a good idea to adjust the log for those who set the level higher.

[Nish Aravamudan (nacc)]

Detail = Low is the default, I believe. So it sounds like a feature request as opposed to a bug at this point?

[Bryce Harrington (bryce)]

It sounds like the original issue resolved by restoring the configuration setting to its default, so I think we can resolve the bug.

I confirmed Nish's observation that Detail = Low is indeed the default, so the way we ship should prevent this from getting displayed.

There have been 47 changes to the dovecot script for logwatch, so it's definitely getting attention and refinements upstream. In a cursory look at the rules I didn't spot one that looks like it'd match the originally reported lines, however with the number of changes to the rules, I would recommend re-testing against current logwatch in eoan and opening a bug upstream if there are other extraneous dovecot messages. Bugs can be filed upstream at https://sourceforge.net/p/logwatch/bugs/