fredrik/logcheck
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Lägger reglerna i egna filer

Browse Source
This commit is contained in:
fredrik
2021-10-25 13:18:49 +02:00
parent 8985e6e4d3
commit 526a7c8c97
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
logcheck-fw-dovecot
View File

@@ -1,3 +1,5 @@
#Oct 25 06:13:28 nada dovecot: imap(fredrik)<24465><CRYxlSXPtyEuOxpv>: Connection closed (LIST finished 0.620 secs ago) in=50 out=4460 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
#Oct 25 11:10:57 nada dovecot: imap(cali)<31529><VbkTvSnPOGtU2IAZ>: Connection closed (LIST finished 0.658 secs ago) in=50 out=4627 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
#Oct 25 11:11:00 nada dovecot: imap(cali)<31531><bys4vSnPNGtU2IAZ>: Connection closed (UID FETCH finished 0.341 secs ago) in=2206 out=17894 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([[:alnum:]]+\):\<[[:alnum:]]+\>\<[[:alnum:]]+\> Connection closed.*
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: imap\([[:alnum:]]+\):\<[[:alnum:]]+\>\<[[:alnum:]]+\>: Connection closed.*

4
logcheck-fw-saslauthd
View File

@@ -5,5 +5,7 @@
#Apr 2 16:58:34 nada saslauthd[619]: do_auth : auth failure: [user=prueba] [service=smtp] [realm=] [mech=shadow] [reason=Invalid username]
#Apr 2 19:08:45 nada saslauthd[604]: do_auth : auth failure: [user=backup] [service=smtp] [realm=] [mech=shadow] [reason=Incorrect password]
#Feb 6 02:20:14 nada saslauthd[610]: do_auth : auth failure: [user=Adm1n!] [service=smtp] [realm=#] [mech=shadow] [reason=Invalid username]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saslauthd\[[[:digit:]]+\]: do_auth[[:blank:]]+: auth failure: \[user=([[:print:]]+)?\] \[service=(smtp)?\] \[realm=([[:print:]]+)?\] \[mech=(pam|shadow)\] \[reason=(Unknown|PAM auth error|Invalid username|Incorrect password)\]
#Oct 25 11:21:07 nada saslauthd[276]: : auth failure: [user=sales] [service=smtp] [realm=] [mech=shadow] [reason=Invalid username]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saslauthd\[[[:digit:]]+\]: (do_auth)?[[:blank:]]+: auth failure: \[user=([[:print:]]+)?\] \[service=(smtp)?\] \[realm=([[:print:]]+)?\] \[mech=(pam|shadow)\] \[reason=(Unknown|PAM auth error|Invalid username|Incorrect password)\]