Home / server / Questions / 269693
In Process
Minhaj
Asked: 2011-05-15 01:13:38 +0800 CST

Pop-before-smtp $pat regex for Dovecot in iRedmail

  • 772

I've installed pop-before-smtp in my mail server(iredmail). I need help to configure the $pat to read the pattern of my Dovecot file. Dovecote log file is like this:

2011-05-14 14:01:21 pop3-login: Info: Login: user=<[email protected]>, method=PLAIN, rip=180.234.45.133, lip=66.165.162.157
2011-05-14 14:01:22 POP3([email protected]): Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0
2011-05-14 14:01:52 pop3-login: Info: Login: user=<[email protected]>, method=PLAIN, rip=180.234.45.133, lip=66.165.162.157
2011-05-14 14:01:53 POP3([email protected]): Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0

Pop-before-smtp script by default offer this pattern for Dovecot. But it's not working for me. None of 3 of the pattern. 

# For Dovecot POP3/IMAP when using syslog.
$pat = '^[LOGTIME] \S+ (?:dovecot: )?(?:imap|pop3)-login: ' .
    'Login: .*? (?:\[|rip=)[:f]*(\d+\.\d+\.\d+\.\d+)[],]';
$out_pat = '^[LOGTIME] \S+ (?:dovecot: )?(?:imap|pop3)-login: ' .
    'Disconnected.*? (?:\[|rip=)[:f]*(\d+\.\d+\.\d+\.\d+)[],]';

# For Dovecot POP3/IMAP when it does its own logging.
$logtime_pat = '(\d\d\d\d-\d+-\d+ \d+:\d+:\d+)';
$pat = '^dovecot: [LOGTIME] Info: (?:imap|pop3)-login: ' .
    'Login: .+? rip=[:f]*(\d+\.\d+\.\d+\.\d+),';
$out_pat = '^dovecot: [LOGTIME] Info: (?:imap|pop3)-login: ' .
    'Disconnected.*? rip=[:f]*(\d+\.\d+\.\d+\.\d+),';

# For older Dovecot POP3/IMAP when it does its own logging.
$pat = '^(?:imap|pop3)-login: [LOGTIME] Info: ' .
    'Login: \S+ \[[:f]*(\d+\.\d+\.\d+\.\d+)\]';
$out_pat = '^(?:imap|pop3)-login: [LOGTIME] Info: ' .
    'Disconnected.*? \[[:f]*(\d+\.\d+\.\d+\.\d+)\]';

Pop-before-smtp needs to read the IP from the log by regex. Kindly help me on this. Thanks

regex dovecot

1 Answers

  1. I've got it working with this regex format:

    $pat = '^(\d\d\d\d-\d+-\d+ \d+:\d+:\d+) (?:imap|pop3)-login: Info: ' .
'Login: .*? (?:\[|rip=)[:f]*(\d+\.\d+\.\d+\.\d+)[],]';
    • 1