jacksenatore
New member
- Joined
- Dec 2, 2013
- Messages
- 1
In the Brute Force Monitor DA has a problem in parsing the correct IP address from the "Log Entry". It occurs only with EXIM2
With the EXIM2 LOG ENTRY
2013-12-02 14:01:27 [25473] login authenticator failed for (ylmf-pc) [113.88.41.122]:4505 I=[109.168.114.161]:25: 535 Incorrect authentication data ([email protected])
DA parses the IP as "25473" but the correct one is 113.88.41.122.
With a EXIM1 SLIGHTLY different LOG ENTRY
2013-12-02 14:14:40 [30625] plain authenticator failed for ([192.168.0.6]) [93.56.129.177]:56058 I=[109.168.114.161]:25: 535 Incorrect authentication data ([email protected])
DA parses correctly the IP as "93.56.129.177"
With a DOVECOT1 LOG ENTRY
Dec 2 11:55:25 cartesio dovecot[1438]: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<[email protected]>, method=PLAIN, rip=188.219.216.48, lip=109.168.114.161, session=<s+tDBIvsFQC829gw>
DA parses correctly the IP as "188.219.216.48"
Does anyone has any idea?
With the EXIM2 LOG ENTRY
2013-12-02 14:01:27 [25473] login authenticator failed for (ylmf-pc) [113.88.41.122]:4505 I=[109.168.114.161]:25: 535 Incorrect authentication data ([email protected])
DA parses the IP as "25473" but the correct one is 113.88.41.122.
With a EXIM1 SLIGHTLY different LOG ENTRY
2013-12-02 14:14:40 [30625] plain authenticator failed for ([192.168.0.6]) [93.56.129.177]:56058 I=[109.168.114.161]:25: 535 Incorrect authentication data ([email protected])
DA parses correctly the IP as "93.56.129.177"
With a DOVECOT1 LOG ENTRY
Dec 2 11:55:25 cartesio dovecot[1438]: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<[email protected]>, method=PLAIN, rip=188.219.216.48, lip=109.168.114.161, session=<s+tDBIvsFQC829gw>
DA parses correctly the IP as "188.219.216.48"
Does anyone has any idea?
