# postfix-dovecot Mail authentication and relay abuse, read from a single syslog file where rsyslog routes `mail.*` — `/var/log/maillog` here; `/var/log/mail.log` on a stock Debian. Category `mail`. Traditional syslog timestamps (`Aug 14 08:49:30`), which carry no year: the reader supplies its own, and a line dated ahead of it is taken as last year's. **Read the mail log once.** On a machine where `/var/log/syslog` also carries postfix and dovecot lines, declaring both counts every failure twice and halves every threshold without saying so. ## The parsers | parser | what it is | |---|---| | `postfix-sasl-fail` | SMTP authentication refused | | `postfix-relay-denied` | trying to send mail through this server to elsewhere | | `dovecot-auth-fail` | IMAP/POP3/submission login refused | | `dovecot-password-mismatch` | the auth process's view, with a truncated hash of what was tried | | `dovecot-login-ok` | a login that worked — for weighing negatively | The mailbox name is attacker-controlled and dovecot prints it *before* the address, so those patterns run greedily to the last `rip=` on the line. Keep that in anything derived from them.