These are parse_log_sub's contributed by users and not tested by me.


============

qpopper 3.0.2

Bryan T. Schmidt <bts@profitool.com>

$parse_log_sub =
sub {
  my $line = shift;
  # the following will match log entries output from qpopper (well, v3.0.2 anyway)
  $line=~ /popper.*:.*POP login by user.* \
(\d+\.\d+\.\d+\.\d+)$/ && return $1;
  return undef;
};

============

openBSD 2.8 with qmail and qpopper for pop3

adam <bezanson@mediaone.net>

$parse_log_sub =
sub {
  my $line = shift;
  # the following will match log entries output from qpopper (well, v3.0.2 anyway)
  $line =~ /qpopper.*POP login by user .* at \((.*)\)/ && return $1;
  return undef;
};

============

SuSE-6.3 Linux Server with qmail and solid pop3 v0.15 (spop3d) via inetd.
The smtp-poplock deamon is configured to observe the logfile written by syslogd.

reported by Urs Hunkeler <urs.hunkeler@novatik.com> on Mon Jun  4 11:33:43 EDT 2001

The log-lines look like:

Jun 4 14:20:00 mainframe spop3d[12345]: user test authenticated - 123.123.123.123
(when reverse lookup of ip address fails or)
Jun 4 14:20:00 mainframe spop3d[12345]: user test authenticated - test.novatik.com (123.123.123.123)

I've hardly ever programmed in perl, but I managed to get a working
regex.

$parse_log_sub =
sub {
   my $line = shift;
   $line =~ m/^.*spop3d.*: user .* authenticated - ([\w\.]+).*$/ && return $1;
   return undef;
};

============

imap-4.7c2-12 (http://www.washington.edu/imap/).

Reported by Fabio Inguaggiato <fabio@pieris.it>.

$parse_log_sub =
sub {
  my $line = shift;
  $line =~ m/^.*ipop3d\[.*\]: Login user=.* host=\[(.*)\].*$/ && return $1;
  return undef;
};

============

Slackware 7.1 system with in.pop3d 1.006d.

Reported by Joakim Mared <joakim@champion.se>.

$parse_log_sub =
sub {
   my $line = shift;
  $line =~ m/pop3d\[.+?\]: Servicing \w+ \@ (.+?)$/ && return $1;
  return undef;
};

============

Thu Oct 11 10:16:35 EDT 2001

Courier IMAP and POP3 servers (used in SSL and non-SSL modes) on
Digital UNIX.

Please note: the default routine in smtp-poplock allowed a user to relay
just by sending a bad login to the POP3 server... maybe that default
needs reevaluated.... anyhoo:

Reported by Bryan T. Schmidt <bts@profitool.com>.

$parse_log_sub =
sub {
    my $line = shift;
    $line =~ m/[pop3dimapd\-ssl]{4,9}: LOGIN, user=[\w\-]*, ip=\[::ffff:([0-9\.]+)\]$/ && return $1;
    return undef;
};

============

Fri 10/19/2001 6:35 AM

Here is the parse_log_sub we're using for our Courier-IMAP and POP setup.

Reported by Peter Conrad <conrad@tivano.de>.

$parse_log_sub =
sub {
    my $line = shift;
    $line =~ m/(couriertls|pop3login|imaplogin): LOGIN, user=\S+, ip=\[(::ffff:)?(\d+\.\d+\.\d+\.\d+)\]$/ && return $2;
    return undef;
};


============

Tue 3/19/2002 10:36 AM

it seems like the qpopper is creating lots of different log format. This one 
works for me (3.0.2):

$line =~ /.*popper.*Stats:.* (\d+ \d+ \d+ \d+) (.*) (\d+\.\d+\.\d+\.\d+)$/ && 
return $2;

The 1st group of 4 digits are (bytes retrived, bytes on server, messages 
retrieved, messages on server) The second is the IP address.

Strange: sometimes the log says popper, sometimes qpopper. I think for 
qpopper there is no other way except everyone figures out a regex for himself.

Reported by Rüdiger Koch <rkoch@rkoch.org>.

============

Fri 3/1/2002 7:58 AM

I drummed up a new parse_log_sub to work with the courier-imap 
package on OpenBSD 2.8 (this package supplies Courier-IMAP version 
1.1). The subroutine is:

$parse_log_sub =
sub {
    my $line = shift;
   $line =~ m/couriertls: LOGIN, user=[^,]+, ip=\[([^]]+)\]$/ && return 
$1;
   return undef;
};

Reported by Matt Van Gundy <matt@jesusisreality.org>.