Re: better logging of qmail-pop3d usage? (bytes, username)

[Joshua Nichols <jnichols@unboundtechnology.com>]

Kyle Wheeler wrote:
> Adding traffic counts is going to be a wee bit harder, and if you don't
> want to use recordio, that may require patching qmail-pop3d.

Though it stands to reason that if there is a great deal of network
traffic generated by qmail-pop3d that it is likely either:

1. Many, many logins; or

2. More messages and/or larger messages than typical.



Case one would be detectable by grep -c on the logs generated with your
proposed script, and case 2 should correlate to qmail-send logs, which
generally contain more information.

One other thing to investigate is if you're getting many failed logins,
which could suggest a brute-force password attack.



--joshua.