Subject: syslog problems witn imapd

From: Marc MERLIN <[email-masked]>
Date: Wed, 31 Oct 2001 19:57:59 -0800

I have been using the latest imap-2001a.RELEASE-CANDIDATE.2 and with that
one, as well as imap-2001.BETA.SNAP-0105251616 (I believe), I have been
having problems with very unreliable sysloging

kenny:/var/local/src/uwimap/patches# telnet localhost 143
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS STARTTLS AUTH=LOGIN] localhost IMAP4rev1 2001.305 at Wed, 31 Oct 2001 19:46:02 -0800 (PST)
1 login merlin xxxx
* CAPABILITY IMAP4REV1 IDLE NAMESPACE MAILBOX-REFERRALS SCAN SORT THREAD=REFERENCES THREAD=ORDEREDSUBJECT MULTIAPPEND
1 OK LOGIN completed
2 select INBOX
* 1 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1002934958] UID validity status
* OK [UIDNEXT 2] Predicted next UID
* FLAGS (\Answered \Flagged \Deleted \Draft \Seen)
* OK [PERMANENTFLAGS (\* \Answered \Flagged \Deleted \Draft \Seen)] Permanent flags
2 OK [READ-WRITE] SELECT completed
3 logout
* BYE kenny.hdqt.valinux.com IMAP4rev1 server terminating connection
3 OK LOGOUT completed

Syslog shows:
Oct 31 19:46:02 kenny imapd[1144]: imap service init from 127.0.0.1
Oct 31 19:46:28 kenny imapd[1193]: imaps SSL service init from 24.18.170.38
Oct 31 19:46:29 kenny imapd[1196]: imaps SSL service init from 24.18.170.38

No
Authenticated user=merlin host=localhost
or 
Logout user=merlin host=localhost

Yet, I have a few of those lines in my logs, just very few.

Apparently, using SSL doesn't make a difference (although the SSL init gets
logged):
Oct 31 19:56:12 kenny tcplogd: imaps connection attempt from localhost [127.0.0.1]
Oct 31 19:56:12 kenny imapd[2745]: connect from localhost
Oct 31 19:56:12 kenny imapd[2745]: imaps SSL service init from 127.0.0.1

This is when I do:
kenny:/var/local/src/uwimap# telnet -z ssl localhost imaps
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS AUTH=PLAIN AUTH=LOGIN] localhost IMAP4rev1 2001.305 at Wed, 31 Oct 2001 19:56:12 -0800 (PST)
1 login merlin xxx
* CAPABILITY IMAP4REV1 IDLE NAMESPACE MAILBOX-REFERRALS SCAN SORT THREAD=REFERENCES THREAD=ORDEREDSUBJECT MULTIAPPEND
1 OK LOGIN completed
2 select INBOX
* 1 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1002934958] UID validity status
* OK [UIDNEXT 2] Predicted next UID
* FLAGS (\Answered \Flagged \Deleted \Draft \Seen)
* OK [PERMANENTFLAGS (\* \Answered \Flagged \Deleted \Draft \Seen)] Permanent flags
2 OK [READ-WRITE] SELECT completed
3 logout
* BYE kenny.hdqt.valinux.com IMAP4rev1 server terminating connection
3 OK LOGOUT completed

Any ideas what could be wrong?
(yes syslog seems to be working on that system otherwise)

Thanks
Marc
-- 
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
  
Home page: http://marc.merlins.org/   |   Finger [email-masked] for PGP key
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Wed, 31 Oct 2001 20:07:24 -0800 (Pacific Standard Time)

Nobody else has reported this problem (yet).

Since you have made numerous patches, have you tried to see if you can
reproduce this problem with unmodified software?

Have you verified that your /etc/syslog.conf file is set appropriately?

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: Thomas Brown <[email-masked]>
Date: Wed, 31 Oct 2001 23:33:31 -0500

The authentication messages use 'info' level, and the connect
messages use 'debug' level.  Try the following in your
syslog.conf:

mail.debug      /var/adm/mail.log (or wherever you send it)

You will then get:

Oct 10 12:37:37 tick imapd[9631]: [ID 806292 mail.debug] imap
service init from 10.207.212.5
Oct 10 12:37:37 tick imapd[9631]: [ID 234311 mail.info] Login
user=mailuser host=mailclient [10.207.212.5]
Oct 10 12:38:14 tick imapd[9631]: [ID 533678 mail.info] Logout
user=mailuser host=mailclient [10.207.212.5]

A similar IMAPS session looks like:

Oct 10 12:21:03 mailhost imapd[9329]: [ID 298158 mail.debug]
imaps SSL service init from 10.57.85.31
Oct 10 12:21:05 mailhost imapd[9329]: [ID 666661 mail.info]
Authenticated user=tbrown host=mailclient [10.57.85.31]
Oct 10 12:28:14 mailhost imapd[9329]: [ID 533678 mail.info]
Logout user=tbrown host=mailclient [10.57.85.31]

Note, however, that most editions of 'sendmail' also use the
'mail' facility by default, with various levels including 'info',
'warning', and 'notice'.  This may not be a problem, however, as
you will have all mail-related logging in one file, and this can
be easily filtered as each program (sendmail, imapd, ipop3d,
etc.) will tag its name on each line.

-Tom