Results 1 to 7 of 7

Thread: Audit

  1. #1
    madunix is offline Senior Member
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default Audit

    i got a question, is there a way to have a more detailed information about auditing ip address with mail user regarding IMAP and pop3 for
    period of Time (example one month), how can i see this?


    Thanks

  2. #2
    uxbod's Avatar
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,016
    Rep Power
    24

    Default

    Check in /opt/zimbra/log/audit.log ... You will have to parse the file yourself looking for the specific access you wish to report on.

  3. #3
    madunix is offline Senior Member
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default

    - I can see only the logs for March 2009 what about other logs for older dates
    - I can see only user name and protocol but not ip inside.
    - do you have a script to point out the username + date + IP + protocol

    Thanks

  4. #4
    uxbod's Avatar
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,016
    Rep Power
    24

    Default

    Look for audit.* as the logs get rotated and gzipped up

  5. #5
    madunix is offline Senior Member
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default

    ls -al audit.*
    -rw-r----- 1 zimbra zimbra 400167 Mar 11 10:44 audit.log
    -rw-r----- 1 zimbra zimbra 1275754 Mar 2 23:59 audit.log.2009-03-02
    -rw-r----- 1 zimbra zimbra 1221143 Mar 3 23:59 audit.log.2009-03-03
    -rw-r----- 1 zimbra zimbra 1156610 Mar 4 23:59 audit.log.2009-03-04
    -rw-r----- 1 zimbra zimbra 1108097 Mar 5 23:59 audit.log.2009-03-05
    -rw-r----- 1 zimbra zimbra 243461 Mar 6 23:59 audit.log.2009-03-06
    -rw-r----- 1 zimbra zimbra 279213 Mar 7 23:59 audit.log.2009-03-07
    -rw-r----- 1 zimbra zimbra 1138293 Mar 8 23:59 audit.log.2009-03-08
    -rw-r----- 1 zimbra zimbra 581126 Mar 9 23:59 audit.log.2009-03-09
    -rw-r----- 1 zimbra zimbra 1214172 Mar 10 23:59 audit.log.2009-03-10

  6. #6
    uxbod's Avatar
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,016
    Rep Power
    24

    Default

    Hmmm, they must be getting purged then. You could write something in perl using File::Tail to monitor the file and write the key information into another file or database for easy reporting ?

  7. #7
    madunix is offline Senior Member
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default

    how can i stop the purge and keep them for longer time such as three months

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Audit log rotation
    By bonoboslr in forum Administrators
    Replies: 0
    Last Post: 02-21-2009, 10:58 AM
  2. IM Audit Zimlet
    By augusto in forum Zimlets
    Replies: 0
    Last Post: 10-16-2008, 01:00 PM
  3. Zimbra IM audit log
    By augusto in forum Administrators
    Replies: 0
    Last Post: 09-26-2008, 05:31 AM
  4. Trying to understand audit log
    By rfoster in forum Administrators
    Replies: 2
    Last Post: 02-13-2008, 02:55 PM
  5. Replies: 1
    Last Post: 10-12-2007, 10:26 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •