[Logwatch] vpopmail additions

Dan Downs ddowns at online-access.com
Thu Dec 16 12:13:46 MST 2004


I'm having a problem adding some new functionality to the vpopmail service.

this was modified from vpopmail v1.4 2002/10/12

while (defined($ThisLine = <STDIN>)) {
   if (
         ( $ThisLine =~ /vpop_mail/ ) #or
#         ( $ThisLine =~ /login success (.*?)\:/i)
      ) {
      # We don't care about these
   } elsif ((undef, $Login) = ($ThisLine =~ /(vchkpw-smtp:.*login success)
(.*?)\:/i )) {
       $SuccessLogins{$Login}++;
   } elsif ($ThisLine =~ /login success (.*?)\:/i) {
      # We don't care about these
TRIM
}

TRIM

if ( (keys %SuccessLogins) ) {
   print "Successfull Logins per user:\n";
   foreach $Line (sort {$SuccessLogins{$a} cmp $SuccessLogins{$b}} keys
%SuccessLogins) {
      print "\t" . $Line . " - ". $SuccessLogins{$Line} . " Time(s)\n";
   }
}

TRIM

I turned on logging on all login attempts in vpopmail to try and help narrow
down which users are sending spam, someone's machine is infected with
something, I just don't know who. Anyways I made the above changes to the
vpopmail script and it runs fine when I do:

# cat /var/log/maillog | ./vpopmail

When I run logwatch I don't get my new section, but I still get everything
else I was getting before.

I'm running logwatch 4.3.1 on rh9.

Any ideas?
Dan Downs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.kaybee.org/pipermail/logwatch/attachments/20041216/fdb8476b/attachment.htm


More information about the Logwatch mailing list