One of Cyrus IMAP's more sophisticated features is the ability to create indexes of messages and mailboxes to allow fast searching of headers and message text.

The indexing is done using squatter, and is best achieved by launching it at regular intervals from cyrus.conf:

There's a bug in the current SASL2 SQL library (libsasl2-modules-sql) which means it logs at debug level all the time, and there's no way of switching it off. This fills up auth.log with junk because the default syslog configuration on Debian logs all auth output including debug which makes logcheck unusable.

Until SASL2 is fixed, the only way I've found to work around this is to reduce the logging level for auth and authpriv to exclude debug messages. For syslog-ng this requires the following change to /etc/syslog-ng/syslog-ng.conf