[Dovecot] Couple of questions about the logs

[e-frog]

On 23.07.2012 18:07, wrote Steve Campbell:
>
> On 7/23/2012 11:54 AM, e-frog wrote:
>> On 23.07.2012 17:31, wrote Steve Campbell:
>>> The log entries for imap disconnection shows a "bytes = x/y" format
>>> where the x equals bytes sent from client and y equals bytes received
>>> from client.
>>>
>>> Can someone explain that a little better to me, please? In an imap
>>> account, does this "y" represent the size of the header information
>>> being returned to the client or the amount of data of the email mailbox?
>>>
>>> Also, is there a way to tell if an email has been deleted (or marked for
>>> deletion) when using an imap client?
>>>
>>> Here's the situation:
>>>
>>> I've got a user who uses imap when using his phone and webmail. When in
>>> the office, he uses a pop3 client on his desktop. He indicates he's
>>> missing some emails from the weekend when first turning on his desktop.
>>> I know of no way to discover if he's deleted and then purged email from
>>> his mailbox using imap clients. I've checked the logs and he does not
>>> access his mailbox simultaneously from any of the 3 clients.
>>>
>>> I can find 31 emails he received since his last pop login on Friday
>>> until his first pop login on Monday. The pop login indicates he received
>>> only 27 emails during the pop retrieval.
>>>
>>> I'm a little lost here. Any help would be appreciated in interpreting
>>> the logs or suggesting how this might have happened.
>>>
>>> thanks
>>>
>>> steve campbell
>>
>> This probably doesn't help with the current case but for the future
>> you could enable mail_log plugin to log several user events:
>>
>> http://wiki2.dovecot.org/Plugins/MailLog
>
> thanks very much. That looks great.
>
> Is there any particular file I should place the particular lines?
>
> steve

For dovecot 2.x.x

conf.d/20-imap.conf: add mail_log and notify to mail_plugins

mail_plugins = $mail_plugins mail_log notify


conf.d/10-logging.conf: There is already a template, just uncomment and 
modify as needed.

# mail_log plugin provides more event logging for mail processes.
plugin {
   # Events to log. Also available: flag_change append
   #mail_log_events = delete undelete expunge copy mailbox_delete 
mailbox_rename
   # Available fields: uid, box, msgid, from, subject, size, vsize, flags
   # size and vsize are available only for expunge and copy events.
   #mail_log_fields = uid box msgid size
}