With only 1 user on the system (me!) and a few mailboxes, my mail.log file is filling up with the following entries:
Feb 25 19:27:53 imap-login: Info: Login: user=xxxx@xxxxk.org, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=326, secured, session=<9iXDVjK8MJ1/AAAB>
Feb 25 19:27:53 imap(xxxx@xxxxk.org): Info: Logged out in=28 out=788
Feb 25 19:27:53 imap-login: Info: Login: user=xxxx@xxxxk.org, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=328, secured, session=<iVPFVjK8NJ1/AAAB>
Feb 25 19:27:53 imap(xxxx@xxxxk.org): Info: Logged out in=28 out=788
Feb 25 19:27:53 imap-login: Info: Login: user=xxxx@xxxxk.org, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, mpid=330, secured, session=<XUrHVjK8OJ1/AAAB>
Feb 25 19:27:53 imap(xxxx@xxxxk.org): Info: Logged out in=28 out=788
I saw a previous discussion where entering a new password seemed to eliminate the problem. I tried that and no luck.
I also saw that the login from 127.0.0.1 is an internal login process and to review the other logs. Not sure where to start with this?? Any ideas?? Is there a way to not log âinfoâ entries? I have no other problems with the MIAB setup, although I have not scaled.
I see this too. For me, itâs my mail.log.1 file that is filling up with these messages. It seems tied to using z-push (Exchange ActiveSync). If I turn off ActiveSync on my mobile devices, those messages go away. Z-push seems to be very chatty and checks for new mail every few seconds, resulting in those messages in the log.
My concern is that the log file mail.log.1 keeps growing (mine is currently 92MB). I donât know why the system is actively writing to both mail.log.1 and mail.log. Normally log files ending in .1, .2, etc. are rotated by the logrotate utility and shouldnât be written to. Not sure why itâs configured this way. Hopefully someone more knowledgeable will chime in.
I think dovecot keeps the reference to the old logfile, even though it is renamed to mail.log.1 So only on restart of the process or on command it releases the logfile.
See Dovecot Logging â Dovecot documentation where dovecot is explicitly reopening the log file after logrotate: doveadm log reopen
To stop logging INFO entries youâll have to take a look at rsyslog: /etc/rsyslog.d/50-default.conf Unfortunately Iâm not sure about the exact config to use You can start by replacing
mail.* -/var/log/mail.log
with
mail.notice -/var/log/mail.log
which should only log entries of level notice and higher (warn, error etc). However, I have not tested this, and I donât know if there are any side effects to this, e.g. some log analysis that will fail because of this, or missed log entries.
Thanks for that. doveadm log find shows that the log file should indeed be /var/log/mail.log. After a reboot, dovecot uses that file; however, after the first logrotate operation, it uses mail.log.1 which is incorrect. Having a look at /etc/logrotate.d/rsyslog, which defines the logrotate behavior for mail.log, the line mentioned in the article you linked (doveadm log reopen) is not present. Running that command manually causes dovecot to use mail.log again as intended.
This should be flagged as a mailinabox bug. Iâll check the proper procedure to so do.
As I noted in one of my previous replies, I think itâs the Z-Push (Exchange Activesync) service. I see the same behavior using my iPhone (many logins every few seconds). Do you have any devices configured for Activesync?
As a test, I turned off my mailinabox account on my iPhone and those logins stopped. As @alento mentioned, youâll still see periodic logins from any connected IMAP clients and the integrated Roundcube Web client as well, but less often. Z-Push apparently logs in frequently, presumably to support the Push functionality.
@cinergi I deleted my 2 âExchangeâ accounts on my ipad and iphone prior to the screen shot below. Probably ~15 minutes before the time stamps. Also, I have a PC with MS Outlook and I just booted into it and Iâm writing this note on it. The point being it couldnât have been my Outlook PC client.
All of these logins are coming from 127.0.0.1. So itâs an internal process somewhere that is constantly logging in and out of Dovecot.
Iâm at a loss of what to do and how to even turn off the info log level. Otherwise, MIAB is working well. I just donât want to add other users if this is whatâs going to potentially happen.
After deleting my ipad and iphone email account profiles on the MIAB and rebooting the MIAB server, logs were quite.
I added an IMAP account profile to my iphone for the MIAB account, and immediately starting getting the same blast of multiple logins per second.
5+ minutes later, the iphone is still âupdatingâ my MIAB emails. I donât have that many emails on my MIAB and I have high-speed internet, 200+ mbs.
I will go back to setting up an Exchange" account with the active sync. At least that works to download and sync my email.
Thereâs a bug in this system somewhere and given I am new to this with a fresh install of v 0.52, I am really surprised Iâm the only one with this issue.
BTW⌠Iâve got all âcheckmarksâ on my MIAB âStatus Checksâ dashboard.
Oh for your info, just checked my mail.log and I somehow got the same sort of flooding from 127.0.0.1âŚhmm it could have been due to some un-ended session from round cube / next cloud since itâs only for one of the active accounts, not all my mail accounts ( so z-push is ruled out. ).
Nevertheless, a simple restart of dovecot stopped all the re-logins.
sudo tail -f /var/log/mail.log //monitor your logs sudo service dovecot stop //stop dovecot for a while, notice the login stops. sudo service dovecot start //no more floods.
You can start by replacing
