Tomcat logs

[Valerion]

What you displayed was a mail delivery message, as audited on the Service Router. Maybe this was sent after you logged in but before you ran tail -f?

Less the file to see if the login messages are in there as well.

[kool_kid]

here is the output with less but I don't seem to find the ip address with which user access mail box or sent/received mails

Code: Select all

routing
time 1207662921 Tue Apr  8 19:25:21 2008 +330
type 1 reply
priority 0 normal
sensitivity 0 normal
importance 0 normal
created-locally 0
hop-count 1
ua-ack-id 20984464.11231207661773331.JavaMail.root(a)email.tiptonservices.com
subject RE: Email Ticketing Project
ua-message-id 000f01c89980(036)3b566340(036)b20329c0(036)(a)net
mta-message-id 000f01c89980(036)3b566340(036)b20329c0(036)(a)net
originator aqil / internet DDT1=RFC-822; DDV1=aqil@legaladvantage.net;
part-size 489
part-type 1166 DISTRIBUTION LIST
part-size 635
part-type 1167 TEXT
part-size 25119
part-type 2133 HTML
recipient-to Misbah Hussaini / email/CN=Misbah Hussaini
ack-req 0 none
queue LOCAL
max-nest-depth 0
message-size 29328
part-count 3
delivered-count 1

routing
time 1207662928 Tue Apr  8 19:25:28 2008 +330
type 0 message
priority 0 normal
sensitivity 0 normal
importance 0 normal
created-locally 0
hop-count 1
ua-message-id 12139953.11451207662911241.JavaMail.root(a)email.tiptonservices.co
m
mta-message-id 12139953.11451207662911241.JavaMail.root(a)email.tiptonservices.c
om
subject Test for designers
originator Lavakesh Mudaliar QC. / email/CN=Lavakesh Mudaliar
part-size 622
part-type 1166 DISTRIBUTION LIST
part-size 397
part-type 1167 TEXT
part-size 1369
part-type 2133 HTML
part-size 100062
part-type 0 BINARY FILE
recipient-cc Sameer Hussain SM. / email/CN=Sameer Hussain
ack-req 0 none
queue LOCAL
recipient-to Venkat R PM. / email/CN=Venkatramana
ack-req 0 none
queue LOCAL
max-nest-depth 0
message-size 105643
part-count 4
delivered-count 2



[mikevl]

Hi

using the same settings posted on this thread I get the following results from

/var/opt/scalix/xx/s/logs/audit

cat /var/opt/scalix/xx/s/logs/audit will give you the whole log
if tou have a Redhat system try
nano /var/opt/scalix/xx/s/logs/audit
then you can trol throug the whole log

user-signon
time 1207685578 Wed Apr 9 08:12:58 2008 +720
user-agent-id SWA client
client-ip 192.168.10.234
user 934 Mike /mailnode/CN=Mike 60537 60537
signon-status 0

and

user-signoff
time 1207685580 Wed Apr 9 08:13:00 2008 +720
user 934 Mike /mailnode/CN=Mike
duration 18
signoff-status 0

Even tells me how long I was logged in for


Mike

[mikevl]

Hi

If you need any more logs then for a Redhat system

/var/log/httpd/access_log will provide you with whos comming in from the web

Mike

[Valerion]

You are seeing routing messages, which means you are auditing the Service Router, not the Remote Client Interface. You either set up the auditing incorrectly (check with omshowaud) or did not restart the service after configuring auditing on it.

[kool_kid]

When i enter this command

Code: Select all

omconfaud rci 11
omconfaud -a imap 11

omoff -d0 rci imap
omon rci imap


The rci is updated to log level 11 but the imap is still at loglevel 0. I seen it through omshowuad command. When my clients are logging in, the "client ip" is the ip of the local machine on which scalix is installed though it should be there ISP IP.

example look here

Code: Select all

user-signon
time 1207755143 Wed Apr  9 21:02:23 2008 +330
user-agent-id SWA client
client-type 12
client-ip 192.168.10.113
user 221 F B/email/CN=F B 60653 60653
signon-status 0

192.168.10.113 is my scalix local ip. The ip from which im accessing this login is an direct ISP login.

[mikevl]

Hi

As mentioned previously you may find what you are looking for in
/var/log/httpd/access (if you have a Redhat base OS)


Mike

[kool_kid]

MikeI know that and I can see it, but what exactly I'm looking at is to have logs along with the user name. the access_log of httpd shows me only the ISP IP which tried to access the scalix login page not the user name along with because of the fact that it is capturing IP's which visit the scalix login page and not the ppl who try to or actually login. The rci seems to be give me the username but not the ISP IP.

[mikevl]

Hi

Yes you are right. It may take a small script to work on the audit logs then match the login times to the access log time and IP. Seems the best option

Mike

[kool_kid]

lol I'm searching for someone who can make such a script.