Administrator's Guide - Kerio Software Archive

Chapter 22 Logs• [16/Jun/2004 18:37:17] — the date and time when the message was rejected.• from — email address of the sender.• to — email address of the recipient.• rejected by spam filter — action performed (rejection by spam filter).• score 9.74, threshold 5.00 — SpamAssassin evaluation.Failed login attemptsThis log contains information about invalid login attempts. These are usually caused byan invalid username/password or blocked IP address. The reason for a specific failedlogin can be found also in the Warning log (see chapter 22.5).[13/Apr/2004 17:35:49] Failed IMAP login from 192.168.36.139,missing parameter in AUTHENTICATE header• [13/Apr/2004 17:35:49] — the date and time of the failed login.• Failed IMAP login — action performed (failed login attempt).• from 192.168.36.139 — IP address of the computer used for login attempt.There are several possible reasons for login failure:• missing parameter in AUTHENTICATE header — an incorrect or invalid headerwith login data has been sent,• authentication method PLAIN is disabled — the authentication method is disabledin Kerio MailServer,• authentication method CRAM_MD5 is invalid or unknown — Kerio MailServeris unable to perform authentication using this method,• error during authentication with method CRAM-MD5 — an error occurred duringauthentication, e.g. during communication with the authentication server,• authentication with method CRAM-MD5 cancelled by user — the authenticationwas cancelled by the user (client),• (Failed IMAP login from 127.0.0.1), authentication method PLAIN — theauthentication of the user failed (the user does not exist, the password is incorrect,the user account in Kerio MailServer is disabled or the authentication couldn’t beperformed due to the lack of authentication data in Active Directory).Server misuse attempts (relaying)An example of relaying attempt:[11/Jun/2004 00:36:07] Relay attempt from IP address61.216.46.197, mail from to rejected• [11/Jun/2004 00:36:07] — the date and time.• Relay attempt — action performed (failed relaying attempt).• 61.216.46.197 — IP address of the computer used for relaying attempt.• from — email address of the sender.• to — email address of the recipient.• rejected — action performed (the message was rejected).254