On the same server, the same user, but in /var/log/maillog, I have 2 different types of log:
One is
Another one is
Another one is
So, the questions are:
1. If I understand correctly, 127.0.0.1 is showing that that user accesses email from webmail? While in the third example, xx.xxx.xxx.xx is their real IP.
2. What is the third arg of command passwd?
3. Why is there only user-email-address in the log in the first case?
Thanks a lot.
One is
Feb 21 03:56:22 server-name dovecot[27687]: auth-worker(2010): passwd(user-email-address): unknown user
Another one is
Feb 21 04:31:34 server-name dovecot[27687]: auth-worker(2795): passwd(user-email-address,127.0.0.1,<YWHvZrFlaot/AAAB>): unknown user
Another one is
Feb 21 02:01:14 server-name dovecot[27687]: auth-worker(27227): passwd(user-email-address,xx.xxx.xxx.xx,<DCBQTa9lZY5xFzJm>): unknown user
So, the questions are:
1. If I understand correctly, 127.0.0.1 is showing that that user accesses email from webmail? While in the third example, xx.xxx.xxx.xx is their real IP.
2. What is the third arg of command passwd?
3. Why is there only user-email-address in the log in the first case?
Thanks a lot.