> > Is there any way to know what username was used in these attempts. > > (An existing one every time or they are choosen from a dictionary?)
> saslauthd is likely logging failure via LOG_AUTH facility, see > /var/log/auth.log or /var/log/secure. Bingo! :-) Names came from dictionary. Thanks. Gabor
