[Dovecot] Couple of questions about the logs

[Steve Campbell]

On 7/23/2012 11:54 AM, e-frog wrote:
> On 23.07.2012 17:31, wrote Steve Campbell:
>> The log entries for imap disconnection shows a "bytes = x/y" format
>> where the x equals bytes sent from client and y equals bytes received
>> from client.
>>
>> Can someone explain that a little better to me, please? In an imap
>> account, does this "y" represent the size of the header information
>> being returned to the client or the amount of data of the email mailbox?
>>
>> Also, is there a way to tell if an email has been deleted (or marked for
>> deletion) when using an imap client?
>>
>> Here's the situation:
>>
>> I've got a user who uses imap when using his phone and webmail. When in
>> the office, he uses a pop3 client on his desktop. He indicates he's
>> missing some emails from the weekend when first turning on his desktop.
>> I know of no way to discover if he's deleted and then purged email from
>> his mailbox using imap clients. I've checked the logs and he does not
>> access his mailbox simultaneously from any of the 3 clients.
>>
>> I can find 31 emails he received since his last pop login on Friday
>> until his first pop login on Monday. The pop login indicates he received
>> only 27 emails during the pop retrieval.
>>
>> I'm a little lost here. Any help would be appreciated in interpreting
>> the logs or suggesting how this might have happened.
>>
>> thanks
>>
>> steve campbell
>
> This probably doesn't help with the current case but for the future 
> you could enable mail_log plugin to log several user events:
>
> http://wiki2.dovecot.org/Plugins/MailLog

thanks very much. That looks great.

Is there any particular file I should place the particular lines?

steve