Skip to main content

Logwatch

pgolding
Hi In the past few days my logwatch log has been filled with the below (an example of each but there are several hundred per day) dovecot: imap(__cpanel__service__auth__imap__07ff7elvabqpv20vd0xqt_iz54vgxiahtwhj0tsimnvbkqdddzp3kmwg8qjou75z): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s) and dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=161.69.162.137, lip=176.67.160.18, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<1X/hxCbpjgChRaKJ>: 1 Time(s) Google is not giving me any real answer, so I am reaching out to see if anyone has any ideas Thanks Paul

Comments

9 comments

Date Votes
  • quietFinn
    The 1st one is cPanel checking that dovecot is running, every 5 minutes. The 2nd one is some kind of failed connection attempt.
    0
  • pgolding
    Hi Thank you for the reply - do you know how I would be able to suppress the messages from appearing in the logwatch log, so I only see information that may be important. As I said these verbose looking logs have only appeared in the past few days Thanks Paul
    0
  • cPanelMichael
    Hello :) Please note that Logwatch is not managed by cPanel. You can find it's configuration file at: /usr/share/logwatch/default.conf/logwatch.conf Local configuration options should be added to: /etc/logwatch/conf/logwatch.conf Check to see what you have configured for the "Detail" parameter in the configuration file. You may want to modify the value to ensure logging is less verbose. Thank you.
    0
  • pgolding
    Thanks Michael it is set to low Any idea what the below is? dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s) Thanks
    0
  • quietFinn
    [quote="pgolding, post: 1491022"> Any idea what the below is? dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)
    As I told in my 1st reply in this thread it's cPanel checking that dovecot is running, every 5 minutes.
    0
  • cPanelMichael
    Yes, the previous post is accurate. It's the Chkservd process ensuring that Dovecot is running. Thank you.
    0
  • friedmayofan
    Great info everyone. my local file just has the line saying: "Local configuration files go here: /usr/share/logwatch/default.conf/logwatch.conf" and it has the same settings as the default. Both set to detail level 0/Low. And I'm getting dovecot running type messages ever since upgrading to CSF 6.37 from 6.22. I guess my question is: how do I disable those messages in my logwatch file? I just looked at the documentation and couldn't find this.
    0
  • cPanelMichael
    [quote="friedmayofan, post: 1501821">Great info everyone. my local file just has the line saying: "Local configuration files go here: /usr/share/logwatch/default.conf/logwatch.conf" and it has the same settings as the default. Both set to detail level 0/Low. And I'm getting dovecot running type messages ever since upgrading to CSF 6.37 from 6.22. I guess my question is: how do I disable those messages in my logwatch file? I just looked at the documentation and couldn't find this.
    The following thread may be of help to you: Dovecot 2.2 LFD Alerts Thank you.
    0
  • friedmayofan
    To ignore the first item: [QUOTE]dovecot: imap(__cpanel__service__auth__imap__zynltmk_jf8omopxw0hbf0u8y4jama4g6lsiyeizwou_buaoamf_8j0klmh60dcq): Disconnected: Logged out in=11, out=407, bytes=11/407: 1 Time(s)
    just type this into the file /etc/logwatch/conf/ignore.conf: dovecot: imap\(__cpanel__service__auth__imap__ That's what worked for me. to make sure this worked type: logwatch --print and those messages shouldn't be there anymore.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post