The exact field format and list of fields logged in the Message Store log files vary according to the logging options set. This section shows a few examples of interpreting typical sorts of log entries.
When a user types an invalid password, “authentication” failure is logged, as opposed to a “user not found” message. The message “user not found” is the text passed to the client for security reasons, but the real reason (invalid password) is logged.
[30/Aug/2004:16:53:05 -0700] vadar imapd[13027]: Account Notice: badlogin: [192.18.126.64:40718] plaintext user1 authentication failure |
The following example shows why a user cannot log in due to a disabled account. Furthermore, the disabled account is clarified as “(inactive)” or “(hold).”
[30/Aug/2004:16:53:31 -0700] vadar imapd[13027]: Account Notice: badlogin: [192.18.126.64:40720] plaintext user3 account disabled (hold) |
The following example shows an append message, which occurs when whenever a message is appended to a folder. The Message Store log records all messages entering the Message Store through the ims_master and lmtp channels. Records the “append” of user ID, folder, message size, and message ID.
[31/Aug/2004:16:33:14 -0700] vadar ims_master[13822]: Store Information:append: user1:user/user1:659:<Roam.SIMC.2.0.6.1093995286.11265.user1@vadar.siroe.com> |
The Message Store log writes a “fetch” message when a client retrieves a message. The Message Store log records all client fetches of at least one body part. Records the “fetch” of user ID, folder, and message-ID.
[31/Aug/2004:15:55:26 -0700] vadar imapd[13729]: Store Information: fetch:user1:user/user1:<Roam.SIMC.2.0.6.1093051161.3655.user1@vad.siroe.com> |
The Message Store writes an “expunge” message when an IMAP or POP message is removed from a folder (but not removed from the system). It is logged whether it is expunged by the user or a utility. Records the “expunge” of folder and message ID.
31/Aug/2004:16:57:36 -0700] vadar imexpire[13923]: Store Information: expunge:user/user1:<Roam.SIMC.2.0.6.1090458838.2929.user1@vadar.siroe.com> |
If you configure message trace for one msgtrace log file, the normal “login” messages, which appear in the imap and pop log files, are duplicated in the msgtrace file. The following is a normal login message:
[30/Aug/2004:16:53:13 -0700] vadar imapd[13027]: Account Information: login [192.18.126.64:40718] user1 plaintext |