我的 Dovecot 邮件服务器和 Postfix MTA 似乎正在生成有关尝试从本地主机登录的日志。我该如何调查这个问题?
日志摘录:
Jun 8 09:36:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun 8 09:36:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun 8 09:37:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:37:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:37:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun 8 09:37:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun 8 09:38:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:38:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:38:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun 8 09:38:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun 8 09:39:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:39:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:39:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
Jun 8 09:39:31 mailserver postfix/smtpd[16098]: disconnect from localhost[127.0.0.1]
Jun 8 09:40:28 mailserver dovecot: imap-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:40:30 mailserver dovecot: pop3-login: Aborted login (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jun 8 09:40:31 mailserver postfix/smtpd[16098]: connect from localhost[127.0.0.1]
答案1
看起来 Zabbix 每分钟都在监控这些服务,因此生成了大量的日志材料。