>>
>> >
>> >>
>> >>
>> >> I am playing a bit with the monitoring, and I have noticed there
is
>> one
>> >> client of the chart with ~7500, while the others are between ~17
>> >> and
>> ~60
>> >> (dovecot_user_num_cmds).
>> >>
>> >> I assume this is related to the client, or is it possible
something
>> is
>> >> wrong on the server side? Is someone having also such numbers or
is
>> this
>> >> really strange. Is it possible to limit these cmd's?
>> >
>> >Maybe you should look into what command(s) are being executed first?
>> >
>> >event_exporter cmd_export {
>> > format = json
>> > format_args = time-rfc3339
>> > transport = log
>> >}
>> >
>> >metric imap_command {
>> > event_name = imap_command_finished
>> > filter {
>> > user = anomalous
>> > }
>> > exporter = cmd_export
>> >}
>> >
>>
>> Is there also a way to do this on dovecot 2.2?
>
>With rawlogs, I suppose.
>
If I get this raw log, I am getting huge amount of lists
cut -d ' ' -f2 20201230-181651-16624.out |sort | uniq -c | sort -n
..
17 FLAGS
20 0
328 NO
1284 )
1284
9021 OK
133350 LIST
