[BlueOnyx:11275] show all login failures?

[Roy Urick]

We started seeing the host blocks kick in yesterday against the IP of our
corporate firewall. 

 

At first we thought it was the conversion we are doing and that the server
running popcon was causing failures due to accounts with bad passwords.
However when I tail the maillog and grep for "(auth failed" the number of
failures doesn't match the failure count on the server gui. The server is
reporting approximately 2-3 failed logins for every auth failed line we see
in the maillog. 

 

I have dug around the other logfiles in that directory and don't see any
other failed login references. Also the gui doesn't seem to pace the errors
in maillog exactly as its incrementing faster than the logfile. 

 

Where else do I look to figure out what could be causing the login failures?

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20120905/a0f7bc5f/attachment.html>