Monitoring Dovecot
Dovecot is recognised by its dovecot process and monitored from the log it already
writes: logins and failed authentications become rates, the IMAP port gets a liveness check,
and a brute-force rule ships enabled. There is nothing to configure unless Dovecot logs
somewhere the agent cannot find.
How Dovecot is recognised
The signed definition matches a host running a process named dovecot. Once matched, the
agent runs dovecot --version for the version fact and doveconf -h log_path to learn
where Dovecot writes its log. When log_path names a file, that file is tailed. When it is
empty because Dovecot logs through syslog, the agent falls back to /var/log/mail.log and
then /var/log/maillog, whichever exists, which covers the Debian and RHEL families. Every
probe runs every 60 seconds; the log tail reads only what was appended since its last pass.
What is collected
Logins and failures. Two counters run over the new log lines: imap-login: Login
lines become the login rate, auth failed lines become the failed-authentication rate,
both per second. This is where a dictionary attack shows up first.
IMAP liveness. A connection to 127.0.0.1:143 has to be accepted. If Dovecot holds the
port but never completes the accept, the check says "the port is bound but the service is
not accepting connections" instead of reporting a closed port.
Facts shown on the host page: version and the resolved log path.
| Signal | Metric |
|---|---|
| IMAP logins per second | svc.dovecot.login_rate |
| Failed authentications per second | svc.dovecot.auth_fail_rate |
Names, tags and units are in the metrics reference.
Logs. Dovecot's journal entries ship at notice level and above. When Dovecot writes its
own log file, that file ships too, with the level read from Dovecot's Error:,
Warning:, Info: prefixes, so Info and Debug lines stay on the host unless you
switch the service to full depth in the console. See Logs.
Alerts out of the box
| Rule | Fires when | Severity | Ships |
|---|---|---|---|
| Mail brute-force in progress | 0.3 or more failed authentications per second, sustained for two minutes | warning | on |
That is eighteen failures a minute, held for two minutes. No human types that fast, and the two-minute hold outlasts the burst a single misconfigured client produces before it gives up, so what remains is a dictionary run. The incident closes once failures fall under 0.1 per second. It is the same threshold the SSH brute-force rule uses. Thresholds and hysteresis are in the rules catalog.
When a path is not where Dovecot says it is
The log path comes from doveconf. If Dovecot logs through syslog to a file that is
neither /var/log/mail.log nor /var/log/maillog, point the agent at it:
sudo wakora --set dovecot.log-path=/var/log/dovecot/dovecot.log
Keys are listed in Agent configuration.
Limitations
- The login rate counts IMAP logins only (
imap-loginlines); POP3 logins are not counted. Failed authentications are counted for every protocol. - Only port 143 is probed. IMAPS on 993 and the POP3 ports are not checked.
- Failures are a rate, not a list: the rule tells you an attack is running, not where it comes from. There is no per-source counter for Dovecot.
- Mailbox sizes, quota, replication and per-user statistics are not collected, and
doveadm statsis not read; everything comes from the log.