Logwatch

[pgolding]

Hi

In the past few days my logwatch log has been filled with the below (an example of each but there are several hundred per day)

dovecot: imap(__cpanel__service__auth__imap__07ff7elvabqpv20vd0xqt_iz54vgxiahtwhj0tsimnvbkqdddzp3kmwg8qjou75z): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)

and

dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=161.69.162.137, lip=176.67.160.18, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<1X/hxCbpjgChRaKJ>: 1 Time(s)

Google is not giving me any real answer, so I am reaching out to see if anyone has any ideas

Thanks

Paul

 

[quietFinn]

The 1st one is cPanel checking that dovecot is running, every 5 minutes.
The 2nd one is some kind of failed connection attempt.

 

[pgolding]

Hi

Thank you for the reply - do you know how I would be able to suppress the messages from appearing in the logwatch log, so I only see information that may be important.

As I said these verbose looking logs have only appeared in the past few days

Thanks

Paul

 

[cPanelMichael]

Hello

Please note that Logwatch is not managed by cPanel. You can find it's configuration file at:

/usr/share/logwatch/default.conf/logwatch.conf

Local configuration options should be added to:

/etc/logwatch/conf/logwatch.conf

Check to see what you have configured for the "Detail" parameter in the configuration file. You may want to modify the value to ensure logging is less verbose.

Thank you.

 

[pgolding]

Thanks Michael it is set to low

Any idea what the below is?

dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)


Thanks

 

[quietFinn]

Any idea what the below is?

dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)

As I told in my 1st reply in this thread it's cPanel checking that dovecot is running, every 5 minutes.

 

[cPanelMichael]

Yes, the previous post is accurate. It's the Chkservd process ensuring that Dovecot is running.

Thank you.

 

[friedmayofan]

Great info everyone.

my local file just has the line saying: "Local configuration files go here: /usr/share/logwatch/default.conf/logwatch.conf"
and it has the same settings as the default. Both set to detail level 0/Low. And I'm getting dovecot running type messages ever since upgrading to CSF 6.37 from 6.22. I guess my question is: how do I disable those messages in my logwatch file? I just looked at the documentation and couldn't find this.

 

[cPanelMichael]

Great info everyone.

my local file just has the line saying: "Local configuration files go here: /usr/share/logwatch/default.conf/logwatch.conf"
and it has the same settings as the default. Both set to detail level 0/Low. And I'm getting dovecot running type messages ever since upgrading to CSF 6.37 from 6.22. I guess my question is: how do I disable those messages in my logwatch file? I just looked at the documentation and couldn't find this.

The following thread may be of help to you:

Dovecot 2.2 LFD Alerts

Thank you.

 

[friedmayofan]

To ignore the first item:

dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)

just type this into the file /etc/logwatch/conf/ignore.conf:
dovecot: imap\(__cpanel__service__auth__imap__

That's what worked for me.
to make sure this worked type:
logwatch --print

and those messages shouldn't be there anymore.