[Dovecot] Couple of questions about the logs

[e-frog]

On 23.07.2012 17:31, wrote Steve Campbell:
> The log entries for imap disconnection shows a "bytes = x/y" format
> where the x equals bytes sent from client and y equals bytes received
> from client.
>
> Can someone explain that a little better to me, please? In an imap
> account, does this "y" represent the size of the header information
> being returned to the client or the amount of data of the email mailbox?
>
> Also, is there a way to tell if an email has been deleted (or marked for
> deletion) when using an imap client?
>
> Here's the situation:
>
> I've got a user who uses imap when using his phone and webmail. When in
> the office, he uses a pop3 client on his desktop. He indicates he's
> missing some emails from the weekend when first turning on his desktop.
> I know of no way to discover if he's deleted and then purged email from
> his mailbox using imap clients. I've checked the logs and he does not
> access his mailbox simultaneously from any of the 3 clients.
>
> I can find 31 emails he received since his last pop login on Friday
> until his first pop login on Monday. The pop login indicates he received
> only 27 emails during the pop retrieval.
>
> I'm a little lost here. Any help would be appreciated in interpreting
> the logs or suggesting how this might have happened.
>
> thanks
>
> steve campbell

This probably doesn't help with the current case but for the future you 
could enable mail_log plugin to log several user events:

http://wiki2.dovecot.org/Plugins/MailLog