AppSuite:Log forwarding - Revision history

Khgras at 10:49, 11 September 2019

2019-09-11T10:49:45Z

← Older revision		Revision as of 10:49, 11 September 2019
Line 1:		Line 1:
	= Log Forwarding =		= Log Forwarding =

			For customers using OX as a Service (Managed) or OX App Suite Cloud, Open-Xchange provides highly restricted and TLS-encrypted access to a filtered logstream for customer’s internal purposes.

	== Open-Xchange Logs ==		== Open-Xchange Logs ==

Khgras: /* HTTP */

2019-09-11T10:46:36Z

HTTP

← Older revision		Revision as of 10:46, 11 September 2019
Line 120:		Line 120:
	* openexchange.login.client – login client		* openexchange.login.client – login client
	* openexchange.login.login – login username		* openexchange.login.login – login username
	* login		* login
	* fields		* fields
	* Login – username		* Login – username
	* IP – client ip		* IP – client ip
	* AuthID – auth id		* AuthID – auth id
	* Agent – user Agent		* Agent – user Agent
	* Client – login client		* Client – login client
	* Context – internal context id		* Context – internal context id
	* User – internal user id in context		* User – internal user id in context
	* Session – session Id		* Session – session Id
	* Random – random		* Random – random
	* openexchange.grizzly.remoteAddress – client ip		* openexchange.grizzly.remoteAddress – client ip
	* openexchange.grizzly.serverName – hostname		* openexchange.grizzly.serverName – hostname
	* openexchange.grizzly.userAgent – User		* openexchange.grizzly.userAgent – User
	* openexchange.login.client – login client		* openexchange.login.client – login client
	* openexchange.login.login – login username		* openexchange.login.login – login username
	* logout		* logout
	* fields		* fields
	* Logout – fixed word		* Logout – fixed word
	* Context – internal context id		* Context – internal context id

Khgras at 10:44, 11 September 2019

2019-09-11T10:44:31Z

← Older revision		Revision as of 10:44, 11 September 2019
Line 70:		Line 70:
	== SMTP ==		== SMTP ==

	'''events'''		'''events'''
	* '''failed login'''		* '''failed login'''
	* fields		* fields
Line 111:		Line 111:
	== HTTP ==		== HTTP ==

	'''events'''		'''events'''
	* failed login		* failed login
	* fields		* fields
Line 136:		Line 136:
	* openexchange.login.client – login client		* openexchange.login.client – login client
	* openexchange.login.login – login username		* openexchange.login.login – login username
			* logout
	logout		* fields
	fields		* Logout – fixed word
	Logout – fixed word		* Context – internal context id
	Context – internal context id		* User – internal user id
	User – internal user id		* Session – session id
	Session – session id		* openexchange.grizzly.remoteAddress – client ip
	openexchange.grizzly.remoteAddress – client ip		* openexchange.grizzly.serverName – hostname
	openexchange.grizzly.serverName – hostname		* openexchange.grizzly.userAgent – User
	openexchange.grizzly.userAgent – User

Khgras: /* POP3 */

2019-09-11T10:43:29Z

POP3

@@ Line 41: / Line 41: @@
 == POP3 ==
-  events
+  '''events'''
      * '''failed login'''
          * fields
@@ Line 67: / Line 67: @@
              * TLS – if connection was using tls
              * session – unique session id

Khgras at 10:38, 11 September 2019

2019-09-11T10:38:59Z

← Older revision		Revision as of 10:38, 11 September 2019
Line 39:		Line 39:
	* TLS – if connection was using tls		* TLS – if connection was using tls
	* session – uniqe session id		* session – uniqe session id

			== POP3 ==
			events
			* '''failed login'''
			* fields
			* reason for failed login
			* '''user''' – login username
			* method – authentication method
			* '''rip''' – remote client ip
			* TLS – if connection was using tls
			* session – uniqe session id
			* '''successful login'''
			* fields
			* '''user''' – login username
			* method – authentication method
			* '''rip''' – remote client ip
			* TLS – if connection was using tls
			* session – unique session id
			* logout
			* fields
			* disconnect reason
			* in – bytes received
			* out – bytes sent
			* user – login username
			* method – authentication method
			* rip – remote ip
			* TLS – if connection was using tls
			* session – unique session id

Khgras: /* IMAP */

2019-09-11T10:36:28Z

IMAP

@@ Line 11: / Line 11: @@
 == IMAP ==
-  events
+  '''events'''
-     * failed login
+     * '''failed login'''
          * fields
-             * reason for failed login
+             * '''reason''' for failed login
              * user – login username
              * method – authentication method
              * rip – remote client ip
              * TLS – if connection was using tls
              * session – uniqe session id

Khgras: /* IMAP */

2019-09-11T10:34:32Z

IMAP

← Older revision		Revision as of 10:34, 11 September 2019
Line 12:		Line 12:

	events		events
	failed login		* failed login
	fields		* fields
	reason for failed login		* reason for failed login
	user – login username		* user – login username
	method – authentication method		* method – authentication method
	rip – remote client ip		* rip – remote client ip
	TLS – if connection was using tls		* TLS – if connection was using tls
	session – uniqe session id		* session – uniqe session id
	succesful login		succesful login
	fields		fields

Khgras: /* IMAP */

2019-09-11T10:34:06Z

IMAP

← Older revision		Revision as of 10:34, 11 September 2019
Line 12:		Line 12:

	events		events

	failed login		failed login
	fields		fields

Khgras at 10:33, 11 September 2019

2019-09-11T10:33:50Z

@@ Line 6: / Line 6: @@
 * name=value format (no whitespace in values), space-separated.
 * Non-printable ASCII will be escaped to preserve log integrity
-* Dates are output in the format: YYYY-MMDDTHH:MM:SS.mmm+hh:mm
+* Dates are output in the format: YYYY-MMDDTHH:MM:SS.mmm+hh:mm (+hh:mm should be expected as 00:00 as systems running with UTC)
-(+hh:mm should be expected as 00:00 as systems running with UTC)
+* events and fields in bold should be available with the '''log delivery workaround (AppSuite logs)''' all the fields should be available with the '''log delivery final solution (Dovecot logs)'''
-* events and fields in bold should be available with the ***log delivery workaround (AppSuite logs)*** all the fields should be available with the ***log delivery final solution (Dovecot logs)***

Khgras: Created page with "= Log Forwarding = == Open-Xchange Logs == * Log items are in plain ASCII line-based format, with data usually in * name=value format (no whitespace in values), space-separa..."

2019-09-11T10:31:10Z

Created page with "= Log Forwarding = == Open-Xchange Logs == * Log items are in plain ASCII line-based format, with data usually in * name=value format (no whitespace in values), space-separa..."

New page

= Log Forwarding =

== Open-Xchange Logs ==

* Log items are in plain ASCII line-based format, with data usually in
* name=value format (no whitespace in values), space-separated.
* Non-printable ASCII will be escaped to preserve log integrity
* Dates are output in the format: YYYY-MMDDTHH:MM:SS.mmm+hh:mm
(+hh:mm should be expected as 00:00 as systems running with UTC)
* events and fields in bold should be available with the ***log delivery workaround (AppSuite logs)*** all the fields should be available with the ***log delivery final solution (Dovecot logs)***