Hello, Attached you can find UW-imapd samples and patterns. Please test it and let me know, if you have any login/logout related log message left as "Unknown". Known problem: login failures generate the same name value pairs twice. These patterns were created on Ubuntu 10.04 LTS. I'd be very interested to know, if using them on other distributions or UNIX variants makes a difference. -- Peter Czanik (CzP) <czanik@balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/