# HG changeset patch
# User IBBoard <dev@ibboard.co.uk>
# Date 1446412687 0
# Node ID c858ca1e01d038207a8215bacc48a1c9257af6e1
# Parent  bdbb8f6176c2a9b518f066caf499473fe2e909a9
Move to CentOS7-based dovecot (with a tweak for "in=…") because it seems to match output better

diff -r bdbb8f6176c2 -r c858ca1e01d0 common/logwatch/dovecot
--- a/common/logwatch/dovecot	Sat Oct 31 20:33:05 2015 +0000
+++ b/common/logwatch/dovecot	Sun Nov 01 21:18:07 2015 +0000
@@ -1,5 +1,5 @@
 ########################################################
-# $Id: dovecot 159 2013-08-19 09:35:30Z stefjakobs $
+# $Id: dovecot,v 1.18 2010/09/18 17:41:00 stefan Exp $
 ########################################################
 # $Log: dovecot,v $
 # Revision 1.18  2010/09/18 17:41:00  stefan
@@ -130,14 +130,12 @@
 }
 
 # Handle "dovecot: <svc>" and "dovecot: [ID yyyyy mail.info] <svc"
-# Also handle optional hostname before dovecot tag for syslog format.
-my $dovecottag = qr/(?:[a-z][a-z0-9]+ )?dovecot:(?:\s*\[[^]]+\])?/;
+my $dovecottag = qr/dovecot:(?:\s*\[[^]]+\])?/;
 
 while (defined($ThisLine = <STDIN>)) {
      # remove timestamp.  We can't use *RemoveHeaders because we need the
      # service name
      $ThisLine =~ s/^\w{3} .\d \d\d:\d\d:\d\d (?:[^\s:]* |)//;
-     
      if ( ($ThisLine =~ /(?:ssl-build-param|ssl-params): SSL parameters regeneration completed/) or
           ($ThisLine =~ /ssl-params: Generating SSL parameters/) or
           ($ThisLine =~ /auth-worker/) or
@@ -152,11 +150,11 @@
          # We don't care about these
      } elsif ( $ThisLine =~ /Killed with signal /) {
          $End++;
-     } elsif ( $ThisLine =~ /Dovecot (v\d[^ ]* |)starting up( \(core dumps disabled\))?$/) {
+     } elsif ( $ThisLine =~ /Dovecot (v\d[^ ]* |)starting up( \(.*\))?$/) {
          $Restarts++;
          $End = 0;
-     } elsif ( ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag pop3-login: Login: (.*?) \[(.*)\]/ ) ) or
-               ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag pop3-login: (?:Info: )?Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) ) {
+     } elsif ( ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Login: (.*?) \[(.*)\]/ ) ) or
+               ( ($User, $Host) = ( $ThisLine =~ /^pop3-login: Info: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) ) {
       if ($Host !~ /$IgnoreHost/) {
          $Host = hostName($Host);
          $Login{$User}{$Host}++;
@@ -164,8 +162,8 @@
          $ConnectionPOP3{$Host}++;
          $Connection{$Host}++;
       }
-     } elsif ( ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag imap-login: Login: (.*?) \[(.*)\]/ ) ) or
-               ( ($User, $Host) = ( $ThisLine =~ /^$dovecottag imap-login: (?:Info: )?Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) ) {
+     } elsif ( ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Login: (.*?) \[(.*)\]/ ) ) or
+               ( ($User, $Host) = ( $ThisLine =~ /^imap-login: Info: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) ) {
       if ($Host !~ /$IgnoreHost/) {
          $Host = hostName($Host);
          $Login{$User}{$Host}++;
@@ -173,7 +171,7 @@
          $ConnectionIMAP{$Host}++;
          $Connection{$Host}++;
       }
-   } elsif ( ($User, $Host) = ( $ThisLine =~ /$dovecottag managesieve-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
+   } elsif ( ($User, $Host) = ( $ThisLine =~ /managesieve-login: Login: user=\<(.*?)\>.*rip=(.*)\, lip=/ ) ) {
       if ($Host !~ /$IgnoreHost/) {
          $Host = hostName($Host);
          $SieveLogin{$User}{$Host}++;
@@ -183,15 +181,15 @@
       }
 
 # 'lda' for dovecot 2.0, 'deliver' for earlier versions
-    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda|deliver)\((.*)\): msgid=.*: saved mail to (\S+)/ ) ) {
+    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda|deliver)\((.*)\): msgid=.*: saved mail to (.*)/ ) ) {
       $Deliver{$User}{$Mailbox}++;
 
 # For Sieve-based delivery
-    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda\(|deliver\(|lmtp\(\d+, )(.*)\): (?:[^:]+: )?sieve: msgid=.*: stored mail into mailbox '([^']*)'/ ) ) {
+    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag (?:lda|deliver)\((.*)\): sieve: msgid=.*: stored mail into mailbox '(.*)'/ ) ) {
       $Deliver{$User}{$Mailbox}++;
 
 # LMTP-based delivery
-    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag lmtp\(\d+, (.*)\): [^:]+: msgid=.*: saved mail to (\S+)/ ) ) {
+    } elsif ( ($User, $Mailbox) = ( $ThisLine =~ /^$dovecottag lmtp\(\d+, (.*)\): [^:]+: msgid=.*: saved mail to (.*)/ ) ) {
     # dovecot: [ID 583609 mail.info] lmtp(12782, cloyce@headgear.org): jBt1EfjCMk3uMQAAm9eMBA: msgid=<4D32DB1F.3080707@c-dot.co.uk>: saved mail to INBOX
       $Deliver{$User}{$Mailbox}++;
 
@@ -258,17 +256,12 @@
       $Disconnected{"no reason"}++;
    } elsif (($Reason) = ($ThisLine =~ /Disconnected: (.*) \[/) ) {
       $Disconnected{$Reason}++;
-   } elsif (($Reason) = ($ThisLine =~ /Disconnected: (.*) (bytes|top)=.*/) ) {
+   } elsif (($Reason) = ($ThisLine =~ /Disconnected: (.*) (bytes|top|in)=.*/) ) {
       $Disconnected{$Reason}++;
    } elsif (($Reason) = ($ThisLine =~ /Disconnected \((.*)\):/) ) {
       $Disconnected{$Reason}++;
-   } elsif ($ThisLine =~ /Disconnected (bytes|top)=.*/) {
-      $Disconnected{"No reason"}++;
    } elsif (($Reason, $Host) = ($ThisLine =~ /TLS initialization failed/) ) {
       $TLSInitFail++;
-   } elsif (($Host) = ($ThisLine =~ /Aborted login:.* rip=(.*),/) ) {
-      $Host = hostName($Host);
-      $Aborted{$Host}++;
    } elsif (($Host) = ($ThisLine =~ /Aborted login \[(.*)\]/) ) {
       $Host = hostName($Host);
       $Aborted{$Host}++;
@@ -291,7 +284,7 @@
             ($ThisLine =~ /(IMAP|POP3)\(.+\): Disconnected (bytes|top|rip|user|method)=/) or
             ($ThisLine =~ /(imap\-login|pop3\-login): Disconnected: (bytes|top|rip|user|method)=/) ) { 
       $Disconnected{"no reason"}++;
-   } elsif ( (($Reason) = ($ThisLine =~ /(?:IMAP|POP3).+: Disconnected: (.+) (bytes|top)=/i)) or
+   } elsif ( (($Reason) = ($ThisLine =~ /(?:IMAP|POP3).+: Disconnected: (.+) (bytes|top|in)=/i)) or
           (($Reason) = ($ThisLine =~ /(?:imap\-login|pop3\-login): Disconnected: \(?(.+)\)?: /)) or
             #This one should go away also -mgt
           (($Reason) = ($ThisLine =~ /IMAP.+: Disconnected: (.+)/i)) ) {