logwatch reporting

[Tamsy]

Robert Moskowitz wrote on 20.11.2014 20:41:
> I just launched a new mailserver that is using dovecot.  My previous 
> mailserver used courier-mail.  I am expecting better things with this 
> new server, but I was use to some login information in logwatch that I 
> am not seeing now.  For example I would get:
>
>
>
>  [IMAPd] Logout stats:
>  ====================
>                                     User | Logouts | Downloaded | Mbox 
> Size
>  --------------------------------------- | ------- | ---------- | 
> ----------
>                    user1 at htt-consult.com  |      55 |     219571 
> |          0
>                    user2 at htt-consult.com  |     285 |     221681 
> |          0
>               user3 at labs.htt-consult.com  |      32 |      15183 
> |          0
>  --------------------------------------------------------------------------- 
>
>                                                372 |     456435 
> |          0
>
>
>
>  **Unmatched Entries**
>     Disconnected, ip=[::ffff:107.150.52.84], time=1, starttls=1: 2 
> Time(s)
>
>  ---------------------- IMAP End -------------------------
>
>
> --------------------- POP-3 Begin ------------------------
>
>
>  [POP3] Logout stats (in MB):
>  ============================
>                                     User | Logouts | Downloaded | Mbox 
> Size
>  --------------------------------------- | ------- | ---------- | 
> ----------
>                    user1 at htt-consult.com  |      78 |       5.96 
> |          0
>                    user2 at communaljob.com  |     215 |       9.24 
> |          0
>                    user3 at htt-consult.com  |       1 |       7.47 
> |          0
>                    user4 at htt-consult.com  |       1 |       2.34 
> |          0
>                    user5 at htt-consult.com  |     301 |      31.08 
> |          0
>               user6 at labs.htt-consult.com  |     201 |       4.98 
> |          0
>  --------------------------------------------------------------------------- 
>
>                                                797 |      61.06 
> |       0.00
>
>
>
>  **Unmatched Entries**
>     Disconnected, ip=[::ffff:107.150.52.84]: 2 Time(s)
>     Disconnected, ip=[::ffff:12.159.43.147]: 50 Time(s)
>     Disconnected, ip=[::ffff:172.245.45.20]: 61 Time(s)
>     LOGIN FAILED, user=Alfredo, ip=[::ffff:172.245.45.20]: 1 Time(s)
>     LOGIN FAILED, user=Antonio, ip=[::ffff:172.245.45.20]: 2 Time(s)
>     LOGIN FAILED, user=postmaster, ip=[::ffff:172.245.45.20]: 7 Time(s)
> ....
>     LOGIN FAILED, user=webmaster, ip=[::ffff:172.245.45.20]: 7 Time(s)
>     LOGIN FAILED, user=www, ip=[::ffff:172.245.45.20]: 4 Time(s)
>     Maximum connection limit reached for ::ffff:172.245.45.20: 509 
> Time(s)
>
>  ---------------------- POP-3 End -------------------------
>
>
> Whereas dovecot is only reporting:
>
> --------------------- Dovecot Begin ------------------------
>
>
>
>  Dovecot disconnects:
>     Inactivity: 1 Time(s)
>     Logged out: 379 Time(s)
>     no auth attempts: 5 Time(s)
>     no reason: 1 Time(s)
>     tried to use disabled plaintext auth: 1 Time(s)
>
>  **Unmatched Entries**
>     dovecot: dict: mysql: Connected to localhost (postfix): 351 Time(s)
>
>  ---------------------- Dovecot End -------------------------
>
>
> How can I get more detailed user activity reporting to logwatch?
>
> And why is connection to mysql under Unmatched Entries?



What version of Logwatch is installed on the server and on which distro?
We are using Logwatch here too and the summary for Dovecot is very 
detailed; even more detailed compared to what you got with courier-mail.