Dovecot, imap, and mail.log

Improvements
1

Hey All,

This is more an annoyance than anything that really impacts the server. I have noticed that dovecot and imap spam the mail,log file pretty seriously. This is to the tune of about 3 entries per user per second. These are not failed logon attempts, but actual people either logged in through the web or via activsync.

I am not overly worried about it, but it seems a little crazy that this log file is reaching 300+ MB per week which honestly makes it a real pain to get anything useful out of. I am considering setting dovecot to log to a different file than mail.log to at least make it more useful, but I would love to better understand why there is so many entries for this process.

Here is an example of what I see, and this is just one user for one second.

Jun 29 13:45:51 mail dovecot: imap-login: Login: user=someuser@mydomain.com, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=25106, TLS, session=<ABcpqasZAQB/AAAB>
Jun 29 13:45:51 mail dovecot: imap(someuser@mydomain.com): Disconnected: Logged out in=15 out=409
Jun 29 13:45:51 mail dovecot: imap-login: Login: user=someuser@mydomain.com, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=25108, TLS, session=<mMwqqasZAwB/AAAB>
Jun 29 13:45:51 mail dovecot: imap(someuser@mydomain.com): Disconnected: Logged out in=15 out=409
Jun 29 13:45:51 mail dovecot: imap-login: Login: user=someuser@mydomain.com, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=25110, TLS, session=<6GIsqasZBQB/AAAB>
Jun 29 13:45:51 mail dovecot: imap(someuser@mydomain.com): Disconnected: Logged out in=15 out=409

Does anyone else have this same issue?

2

+1 from me … Would be great to have this a little bit less noisy. :slight_smile:

3

What’s conneting to dovecot?

4

I’d guess these are clients using ZPush …

5

I suspect it is zPush as well as I do not remember it being this bad initially when we only did webmail. That being said, I wil try and do some more testing to see if I can narrow it down.

6

Ah, right, so every request to ZPush triggers an IMAP login to check credentials. I don’t want to silence the logs, unless we can silence logins from 127.0.0.1 only, because they may be important for other reasons.

7

I am not suggesting we silence the logs, but perhaps instead of having dovecot pass the logs through syslog to mail, we let dovecot just do it’s own logs into a different file. If you would like I will look into the best way to separate the logs out.