pgolding

Member
Feb 13, 2012
15
0
51
cPanel Access Level
Website Owner
Hi

In the past few days my logwatch log has been filled with the below (an example of each but there are several hundred per day)

dovecot: imap(__cpanel__service__auth__imap__07ff7elvabqpv20vd0xqt_iz54vgxiahtwhj0tsimnvbkqdddzp3kmwg8qjou75z): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)

and

dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=161.69.162.137, lip=176.67.160.18, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<1X/hxCbpjgChRaKJ>: 1 Time(s)

Google is not giving me any real answer, so I am reaching out to see if anyone has any ideas

Thanks

Paul
 

quietFinn

Well-Known Member
Feb 4, 2006
1,222
87
178
Finland
cPanel Access Level
Root Administrator
The 1st one is cPanel checking that dovecot is running, every 5 minutes.
The 2nd one is some kind of failed connection attempt.
 

pgolding

Member
Feb 13, 2012
15
0
51
cPanel Access Level
Website Owner
Hi

Thank you for the reply - do you know how I would be able to suppress the messages from appearing in the logwatch log, so I only see information that may be important.

As I said these verbose looking logs have only appeared in the past few days

Thanks

Paul
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,201
363
Hello :)

Please note that Logwatch is not managed by cPanel. You can find it's configuration file at:

/usr/share/logwatch/default.conf/logwatch.conf

Local configuration options should be added to:

/etc/logwatch/conf/logwatch.conf

Check to see what you have configured for the "Detail" parameter in the configuration file. You may want to modify the value to ensure logging is less verbose.

Thank you.
 
  • Like
Reactions: linux4me2

pgolding

Member
Feb 13, 2012
15
0
51
cPanel Access Level
Website Owner
Thanks Michael it is set to low

Any idea what the below is?

dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)


Thanks
 

quietFinn

Well-Known Member
Feb 4, 2006
1,222
87
178
Finland
cPanel Access Level
Root Administrator
Any idea what the below is?

dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)

As I told in my 1st reply in this thread it's cPanel checking that dovecot is running, every 5 minutes.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,201
363
Yes, the previous post is accurate. It's the Chkservd process ensuring that Dovecot is running.

Thank you.
 

friedmayofan

Member
Apr 21, 2011
21
0
51
cPanel Access Level
Root Administrator
Great info everyone.

my local file just has the line saying: "Local configuration files go here: /usr/share/logwatch/default.conf/logwatch.conf"
and it has the same settings as the default. Both set to detail level 0/Low. And I'm getting dovecot running type messages ever since upgrading to CSF 6.37 from 6.22. I guess my question is: how do I disable those messages in my logwatch file? I just looked at the documentation and couldn't find this.
 
Last edited:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,201
363
Great info everyone.

my local file just has the line saying: "Local configuration files go here: /usr/share/logwatch/default.conf/logwatch.conf"
and it has the same settings as the default. Both set to detail level 0/Low. And I'm getting dovecot running type messages ever since upgrading to CSF 6.37 from 6.22. I guess my question is: how do I disable those messages in my logwatch file? I just looked at the documentation and couldn't find this.
The following thread may be of help to you:

Dovecot 2.2 LFD Alerts

Thank you.
 

friedmayofan

Member
Apr 21, 2011
21
0
51
cPanel Access Level
Root Administrator
To ignore the first item:
dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)
just type this into the file /etc/logwatch/conf/ignore.conf:
dovecot: imap\(__cpanel__service__auth__imap__

That's what worked for me.
to make sure this worked type:
logwatch --print

and those messages shouldn't be there anymore.