Results 1 to 7 of 7

Thread: Audit

Hybrid View

  1. #1
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default Audit

    i got a question, is there a way to have a more detailed information about auditing ip address with mail user regarding IMAP and pop3 for
    period of Time (example one month), how can i see this?


    Thanks

  2. #2
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,017
    Rep Power
    25

    Default

    Check in /opt/zimbra/log/audit.log ... You will have to parse the file yourself looking for the specific access you wish to report on.

  3. #3
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default

    - I can see only the logs for March 2009 what about other logs for older dates
    - I can see only user name and protocol but not ip inside.
    - do you have a script to point out the username + date + IP + protocol

    Thanks

  4. #4
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,017
    Rep Power
    25

    Default

    Look for audit.* as the logs get rotated and gzipped up

  5. #5
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default

    ls -al audit.*
    -rw-r----- 1 zimbra zimbra 400167 Mar 11 10:44 audit.log
    -rw-r----- 1 zimbra zimbra 1275754 Mar 2 23:59 audit.log.2009-03-02
    -rw-r----- 1 zimbra zimbra 1221143 Mar 3 23:59 audit.log.2009-03-03
    -rw-r----- 1 zimbra zimbra 1156610 Mar 4 23:59 audit.log.2009-03-04
    -rw-r----- 1 zimbra zimbra 1108097 Mar 5 23:59 audit.log.2009-03-05
    -rw-r----- 1 zimbra zimbra 243461 Mar 6 23:59 audit.log.2009-03-06
    -rw-r----- 1 zimbra zimbra 279213 Mar 7 23:59 audit.log.2009-03-07
    -rw-r----- 1 zimbra zimbra 1138293 Mar 8 23:59 audit.log.2009-03-08
    -rw-r----- 1 zimbra zimbra 581126 Mar 9 23:59 audit.log.2009-03-09
    -rw-r----- 1 zimbra zimbra 1214172 Mar 10 23:59 audit.log.2009-03-10

  6. #6
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,017
    Rep Power
    25

    Default

    Hmmm, they must be getting purged then. You could write something in perl using File::Tail to monitor the file and write the key information into another file or database for easy reporting ?

  7. #7
    Join Date
    Feb 2008
    Location
    Germany
    Posts
    65
    Rep Power
    7

    Default

    how can i stop the purge and keep them for longer time such as three months

Similar Threads

  1. Audit log rotation
    By bonoboslr in forum Administrators
    Replies: 0
    Last Post: 02-21-2009, 10:58 AM
  2. IM Audit Zimlet
    By augusto in forum Zimlets
    Replies: 0
    Last Post: 10-16-2008, 02:00 PM
  3. Zimbra IM audit log
    By augusto in forum Administrators
    Replies: 0
    Last Post: 09-26-2008, 06:31 AM
  4. Trying to understand audit log
    By rfoster in forum Administrators
    Replies: 2
    Last Post: 02-13-2008, 02:55 PM
  5. Replies: 1
    Last Post: 10-12-2007, 11:26 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •