Force Dovecot not to log connect/disconnect messages
My /var/log/mail.log
gets constantly flooded with Dovecot connect/disconnect messages like this:
Mar 29 18:15:48 summit dovecot: IMAP([email protected]): Disconnected: Logged out bytes=63/2126
Mar 29 18:15:50 summit dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=4.3.2.1, lip=1.2.3.4, TLS
These are repeated ad infinitum (to the tune of 11MB of logs per day), and they're obscuring the more important authentication failures and Postfix deliveries/receptions. I've checked Dovecot's wiki page for logging, but no option there stops these messages. Is there any configuration variable I can set within dovecot.conf
to stop these messages being sent to mail.log
?
Clarification: I still want Dovecot to log to mail.log
; I just don't want it logging these frivolous connect/disconnect messages.
Solution 1:
If you are using rsyslog or syslog-ng you can filter syslog messages. Here is an example from the rsyslog help:
with a simple statement:
:msg, contains, "imap-login" ~
or with the if-else script language:
if $programname == 'dovecot' then {
action(type="omfile" file="/var/log/dovecot.log")
if $msg contains 'imap-login' then
action(type="omfile" file="/var/log/dovecot-login.log")
else
action(type="omfile" file="/var/log/dovecot.log")
}
http://www.rsyslog.com/doc/rsyslog_conf_filter.html