The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Logwatch

Discussion in 'E-mail Discussions' started by pgolding, Oct 21, 2013.

  1. pgolding

    pgolding Member

    Joined:
    Feb 13, 2012
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    Hi

    In the past few days my logwatch log has been filled with the below (an example of each but there are several hundred per day)

    dovecot: imap(__cpanel__service__auth__imap__07ff7elvabqpv20vd0xqt_iz54vgxiahtwhj0tsimnvbkqdddzp3kmwg8qjou75z): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)

    and

    dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=161.69.162.137, lip=176.67.160.18, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<1X/hxCbpjgChRaKJ>: 1 Time(s)

    Google is not giving me any real answer, so I am reaching out to see if anyone has any ideas

    Thanks

    Paul
     
  2. quietFinn

    quietFinn Well-Known Member

    Joined:
    Feb 4, 2006
    Messages:
    998
    Likes Received:
    10
    Trophy Points:
    18
    Location:
    Finland
    cPanel Access Level:
    Root Administrator
    The 1st one is cPanel checking that dovecot is running, every 5 minutes.
    The 2nd one is some kind of failed connection attempt.
     
  3. pgolding

    pgolding Member

    Joined:
    Feb 13, 2012
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    Hi

    Thank you for the reply - do you know how I would be able to suppress the messages from appearing in the logwatch log, so I only see information that may be important.

    As I said these verbose looking logs have only appeared in the past few days

    Thanks

    Paul
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Please note that Logwatch is not managed by cPanel. You can find it's configuration file at:

    /usr/share/logwatch/default.conf/logwatch.conf

    Local configuration options should be added to:

    /etc/logwatch/conf/logwatch.conf

    Check to see what you have configured for the "Detail" parameter in the configuration file. You may want to modify the value to ensure logging is less verbose.

    Thank you.
     
  5. pgolding

    pgolding Member

    Joined:
    Feb 13, 2012
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    Thanks Michael it is set to low

    Any idea what the below is?

    dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)


    Thanks
     
  6. quietFinn

    quietFinn Well-Known Member

    Joined:
    Feb 4, 2006
    Messages:
    998
    Likes Received:
    10
    Trophy Points:
    18
    Location:
    Finland
    cPanel Access Level:
    Root Administrator

    As I told in my 1st reply in this thread it's cPanel checking that dovecot is running, every 5 minutes.
     
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  8. friedmayofan

    friedmayofan Member

    Joined:
    Apr 21, 2011
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Great info everyone.

    my local file just has the line saying: "Local configuration files go here: /usr/share/logwatch/default.conf/logwatch.conf"
    and it has the same settings as the default. Both set to detail level 0/Low. And I'm getting dovecot running type messages ever since upgrading to CSF 6.37 from 6.22. I guess my question is: how do I disable those messages in my logwatch file? I just looked at the documentation and couldn't find this.
     
    #8 friedmayofan, Nov 8, 2013
    Last edited: Nov 8, 2013
  9. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    The following thread may be of help to you:

    Dovecot 2.2 LFD Alerts

    Thank you.
     
  10. friedmayofan

    friedmayofan Member

    Joined:
    Apr 21, 2011
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    To ignore the first item:
    just type this into the file /etc/logwatch/conf/ignore.conf:
    dovecot: imap\(__cpanel__service__auth__imap__

    That's what worked for me.
    to make sure this worked type:
    logwatch --print

    and those messages shouldn't be there anymore.
     

Share This Page