Logwatch and Dovecot 1.x series in FC5

Logwatch is the preferred tool in order to get summaries of the various service logs in Fedora Core 5. It needs very little customization, which mainly summarizes in overriding some of the log file locations. The only issue I have encountered so far is that it cannot parse the Dovecot log entries correctly.

This happens because of two reasons:

Fedora 5 includes dovecot v1.x, which has some differences in its log output format compared to older versions,
the stock logwatch package in Fedora contains a dovecot log parser that supports dovecot up to the 0.99.x version.

This issue’s resolution is rather simple.

First of all, get the updated dovecot log parser from the logwatch CVS repository. I used the latest revision, 1.4 at the moment of writing. Create a services/ directory inside the /etc/logwatch/scripts/ directory, put the updated parser in there and set its executable bit:

# chmod u+x /etc/logwatch/scripts/services/dovecot

This script will be the one to parse the Dovcecot log file instead of the default one.

Next, it is required to override a setting in the dovecot service’s configuration file. So, create a text file, named dovecot.conf, in /etc/logwatch/conf/services/ and write the following line:

*OnlyService = (imap-login|pop3-login|dovecot)

Now, test if it works:

# logwatch --service dovecot --range yesterday --detail 10 --print

This will print the dovecot report to stdout.

There are some things that you should take a note of. The logwatch Dovecot report will work only if dovecot is configured to record its log entries to the system log (syslog), which in turn moves these entries to /var/log/maillog. If you have configured Dovecot to record its log entries to a separate file, other than syslog, then it is very unlikely that the whole thing will work for any Dovecot version. This is because of the different way log entries are written to the separate log.

Related Articles