Audit

[madunix]

i got a question, is there a way to have a more detailed information about auditing ip address with mail user regarding IMAP and pop3 for
period of Time (example one month), how can i see this?


Thanks

[uxbod]

Check in /opt/zimbra/log/audit.log ... You will have to parse the file yourself looking for the specific access you wish to report on.

[madunix]

- I can see only the logs for March 2009 what about other logs for older dates
- I can see only user name and protocol but not ip inside.
- do you have a script to point out the username + date + IP + protocol

Thanks

[uxbod]

Look for audit.* as the logs get rotated and gzipped up

[madunix]

ls -al audit.*
-rw-r----- 1 zimbra zimbra 400167 Mar 11 10:44 audit.log
-rw-r----- 1 zimbra zimbra 1275754 Mar 2 23:59 audit.log.2009-03-02
-rw-r----- 1 zimbra zimbra 1221143 Mar 3 23:59 audit.log.2009-03-03
-rw-r----- 1 zimbra zimbra 1156610 Mar 4 23:59 audit.log.2009-03-04
-rw-r----- 1 zimbra zimbra 1108097 Mar 5 23:59 audit.log.2009-03-05
-rw-r----- 1 zimbra zimbra 243461 Mar 6 23:59 audit.log.2009-03-06
-rw-r----- 1 zimbra zimbra 279213 Mar 7 23:59 audit.log.2009-03-07
-rw-r----- 1 zimbra zimbra 1138293 Mar 8 23:59 audit.log.2009-03-08
-rw-r----- 1 zimbra zimbra 581126 Mar 9 23:59 audit.log.2009-03-09
-rw-r----- 1 zimbra zimbra 1214172 Mar 10 23:59 audit.log.2009-03-10

[uxbod]

Hmmm, they must be getting purged then. You could write something in perl using File::Tail to monitor the file and write the key information into another file or database for easy reporting ?

[madunix]

how can i stop the purge and keep them for longer time such as three months