different auth-worker log

gate2vn

Verified User
Joined
Nov 9, 2004
Messages
483
Location
Oslo
On the same server, the same user, but in /var/log/maillog, I have 2 different types of log:
One is

Feb 21 03:56:22 server-name dovecot[27687]: auth-worker(2010): passwd(user-email-address): unknown user

Another one is

Feb 21 04:31:34 server-name dovecot[27687]: auth-worker(2795): passwd(user-email-address,127.0.0.1,<YWHvZrFlaot/AAAB>): unknown user

Another one is
Feb 21 02:01:14 server-name dovecot[27687]: auth-worker(27227): passwd(user-email-address,xx.xxx.xxx.xx,<DCBQTa9lZY5xFzJm>): unknown user

So, the questions are:
1. If I understand correctly, 127.0.0.1 is showing that that user accesses email from webmail? While in the third example, xx.xxx.xxx.xx is their real IP.
2. What is the third arg of command passwd?
3. Why is there only user-email-address in the log in the first case?

Thanks a lot.
 
Back
Top