audit webmail login (attempts)

[deyjvu]

You could try audit logging for the IMAP process - omconfaud -a imap # - but this doesn't appear to give you any indication if a user has failed to logon .

Then there is the swa.properties file that has logging options at the bottom for you to try, you can set this logging up for individual users for testing.

[ls-al]

IMAP audit on level 11 was logging this for a login attempt with a wrong password:

Code: Select all

user-signon
time 1268737065 Tue Mar 16 11:57:45 2010 +60
user-agent-id IMAP4 Server 11.4.6.13676
client-type 14
client-ip 10.10.10.10
user 108 John Doe/mailnode/CN=John Doe 60541 0
signon-status 655


655 means authentication failed.
The reported IP belongs to the server itself.
If you need to know the IP address of the client you will have to check the Apache logs for the time in question.