Postfix user login file

Question

I am Linux centos for my email server. I have already tried with "tail -f /var/log/mail.log and /var/log syslog". Now where can I find my email users last 1 month login logs?

Thanks

Answer 1

Postfix logs this in /var/log/mail.log.

The lines should look like this:

Jun 21 11:51:06 mail postfix/submission/smtpd[309323]: 713F519C17DC: client=client.example.com[xx.yy.aa.bb], sasl_method=LOGIN, sasl_username=user@example.com

To filter them you can use zgrep:

zgrep -E "submission.+LOGIN" /var/log/mail.log*

Then you can use grep for further filtering, for example exclude failed logins or filter for a specific month or day.

If you need this on a regular basis it might be worth to send the logs into a database, for example an ELK stack.