Re: [cobalt-users] user logging

["Edward Bishop" <eddie@xxxxxxxxxxxxxxxx>]

> > Is there any log of users POPing or any way of making
> >this show up in maillog?
> >
> > I've been trying to find an answer to this for some months, and have
mooted
> > it on several lists including this one, but no progress.
> >

> look at /var/log/secure
>
> Gerald

Thanks Gerald. That shows qpopper working OK, and the user's IP - but what I
really need is their username. Most of them are on the same dialup so I
can't tell who they are from IP.

> I know this probably doesn't help you much but each of my user's POPs is
> logged in maillog, has been that way since day one. At least you know it
can
> be done....  (RaQ4i)

> Brandon

Mine's a RaQ4 - could that be the difference? Obviously there's a setting to
make somewhere but nobody seems to know. Suggestions have been made that
syslog wasn't compiled with the correct modules but on closer inspection (by
helpful people from the linux-sa list) it proved to be OK.

This RaQ4 is quite new and practically unmodified (apart from recommended
patches).

What file(s) control what goes into maillog? Maybe I can compare mine with
Brandon's. For what it's worth, here's my /etc/syslog.conf:

# /etc/syslog.conf
# Cobalt Networks, Inc. 2000

# Log all kernel messages
kern.*    /var/log/kernel

# Put everything in here
*.*;mail,kern,auth,authpriv.none  /var/log/messages

# Log inetd connections (restricted access)
authpriv.*    /var/log/secure

# Log all other auth messages here (restricted access)
auth.*    /var/log/auth

# Log all the mail messages in one place.
mail.info,mail.*    /var/log/maillog

# Everybody gets emergency messages, plus log them on another
# machine.
*.emerg    *

# Save mail and news errors of level err and higher in a
# special file.
uucp,news.crit    /var/log/spooler

# Save boot messages also to boot.log
local7.*    /var/log/boot.log


Any clues gratefully received as always...

Eddie