IP log

[moron]

where can I find the ip of someone who tried to log on to someone else's account? I checked mailbox.log, zimbra.log, audit.log. but i see only my server address there

[L. Mark Stone]

Please check out the "Logging the Originating IP" section of https://wiki.zimbra.com/wiki/Log_Files

[moron]

Please check out the "Logging the Originating IP" section of https://wiki.zimbra.com/wiki/Log_Files

Sorry, but I'm new and I don't quite understand. If I'm not using a proxy I should only add 127.0.0.1 and the public address where my mail is visible. Got it right?

[L. Mark Stone]

No problem!

First, when posting it's always a good idea to paste the output of "zmcontrol -v" so we know what version of Zimbra you are running.

Zimbra ships with its own proxy (nginx). For several years now, installing the proxy service, even on a single server, has been required.

The wiki article talks about how to make sure the Zimbra proxy service is configured correctly so that the oips (Originating IPs) are passed in to mailbox.log.

As re configurations, Zimbra stores 90+% of its configuration data in three places:

1. LDAP - use "zmprov" to read and make changes
2. /opt/zimbra/conf/localconfig.xml - use "zmlocalconfig" to read and make changes
3. *.in files, mostly in /opt/zimbra conf.

Zimbra ships with zmconfigd, a configuration management daemon. When you make changes in LDAP, zmconfigd every 5-10 minutes will detect these changes and reload/restart the impacted service -- totally rewriting all of the service's configuration files in the process. IOW, if you hand edit say, Postfix's main.cf, once the MTA service restarts, all of your changes will be lost. Best to make those changes using the correct zmprov command.

Hope that helps!
Mark