As of this morning, I received quite a pile of successfull authentication entries for the POP3 service. I haven’t ever received these before.
Was there a change to something about the service yesterday?
JB
I see the same thing in my logwatch now.
I know on my RH9 box I had a NodeWorx (YUM) update to:
php-iworx
vpopmail
vpopmail-doc
So my guess is that is why this is happening now.
Yeah, I’m getting the same in my logwatch. Do we really need to see all the successful logins? Is there a way to stop logging these? My logwatch is already big enough with the hundreds of hack attempts I get a day.
Thx for the responses.
It seems as if it would be nice to specify “failed attempts only” or something similar for the log info on the POP3 side.
JB
Personaly I don’t see it in my logwatch (set on a detail level of 5) but I can see huge entries in /var/log/maillog
For me the pbm may a start option not set correctly. I think of this one :
–enable-logging=e|y|n
Turn on (y) or off (n) logging to syslog or (e) only log errors
Set the level of logging. By default it only logs pop authentication errors. You can turn off all logging by setting it to no. And you can log all pop authentications by setting it to yes.
But I’m not sure
In /services/smtp/run there is only a call of vchkpwd
An Iworx team could answer to this ?
Thanks
Pascal
Anyone from IWorx have a thought on this? I’d love to have the POP3 service only logging failed attempts, instead of "all.*
JB
There’s been no change to vpop in weeks JayBean and Pascal is right that the logging is a compile time option and not configurable after the fact. These messages should have always been there.
Chris
I’m not saying there’s been any recent change, it’s the same issue that’s been there since the POP entries began logging at all.
But, you did answer the original question, which is: “It’s not configurable after the fact.” I just wish we had had the option of configuring that setting to log “Failures Only.”
If that service gets updated in the future, would it be possible to have an option to compile that setting upon install? I’ve got lots of people who have POP3 pulls set on a timed interval, which is filling the log quite considerably.
JB
I can tell you it wasn’t happening before in my logwatch email and it just started since about when this thread first started.
I just checked and my update was on 3-22-05:
1 php-iworx 4.3.9-4.rht90.iworx os applied
2 vpopmail 5.4.9-103.rht90.iworx os applied
3 vpopmail-doc 5.4.9-103.rht90.iworx os applied
Every since this update I have gotten every log’n of POP3 in my logwatch with a detail of 5.
I probably randomly added that option on the 3/22 update. I’ll check it out next time we compile and see if we can either just leave it out or alter it to leave out the successful logins.
Chris
Thanks Chris, much appreciated.
JB
Yeah, it’s not a big deal, but just would be nice whenever you get a chance to fix it.
Thanks! 
What was the final solution for getting rid of these “successful log pop3 attempts”?
My daily log email are HUGE! It is a waste of file space in my Outlook email program.