Intercept Driver: FS (filesystem)

Driver name: fs

• intercept_buffer_max_size isn't currently supported.

FS driver writes intercepted sessions to a Dovecot Filesystems. The file begins with intercept_fs_header_line followed by the protocol traffic in Dovecot rawlog file format. For example:

rip=127.0.0.1 service=imap user=8b80216185b851ce9b2c7f6c4a53e16a
1732198510.211817 O: 1.1 OK [CAPABILITY IMAP4rev1 ...] Logged in
1732198510.211843 I: 1.2 APPEND "inbox" "22-Feb-2008 17:06:23 +0200" {87+}
...
1732198510.211846 O: 1.2 OK [APPENDUID 1732198510 1] Append completed (0.003 + 0.000 + 0.002 secs).
1732198510.211848 I: 1.3 select INBOX
...

Variables

The following Settings Variables are supported by intercept_fs_* settings:

Variable	Description
`user`	user@domain
`crypted_user`	user@domain encrypted via intercept_crypted_user
`protocol`	imap/pop3/lmtp
`local_ip`	local IP
`remote_ip`	remote IP
`local_port`	local port
`remote_port`	remote port
`home`	user's home directory
`session`	session ID

Configuration Options

intercept_fs

Value	Named Filter

Named filter for intercept FS driver settings.

intercept_fs_header_line

Default	[None]
Value	string

Add a header to the log.

See variables for supported variable substitutions.

intercept_fs_rotate_at_midnight

Default	no
Value	boolean

Rotate the log at midnight (server's local timezone).

intercept_fs_rotate_interval

Default	5min
Value	time

Flush log and create a new one this often.

intercept_fs_rotate_size

Default	[None]
Value	size

Rotate the log when it reaches this size.

If 0, never rotate.

Example Configuration

intercept fs {
  fs posix {
    prefix = /tmp/intercept/%{crypted_user}/%{protocol}-
  }
  # TODO: dictmap example

  # Add a header to the log
  header_line = rip=%{remote_ip} protocol=%{protocol} crypted_user=%{crypted_user}

  # Flush log and create a new one every this often
  rotate_interval = 5min

  # Rotate the log at midnight (server's local timezone)
  rotate_at_midnight = yes
}

intercept_debug = yes