[Dovecot] Couple of questions about the logs

[Steve Campbell]

On 7/23/2012 12:23 PM, e-frog wrote:
> On 23.07.2012 18:07, wrote Steve Campbell:
>>
>> On 7/23/2012 11:54 AM, e-frog wrote:
>>> On 23.07.2012 17:31, wrote Steve Campbell:
>>>> The log entries for imap disconnection shows a "bytes = x/y" format
>>>> where the x equals bytes sent from client and y equals bytes received
>>>> from client.
>>>>
>>>> Can someone explain that a little better to me, please? In an imap
>>>> account, does this "y" represent the size of the header information
>>>> being returned to the client or the amount of data of the email 
>>>> mailbox?
>>>>
>>>> Also, is there a way to tell if an email has been deleted (or 
>>>> marked for
>>>> deletion) when using an imap client?
>>>>
>>>> Here's the situation:
>>>>
>>>> I've got a user who uses imap when using his phone and webmail. 
>>>> When in
>>>> the office, he uses a pop3 client on his desktop. He indicates he's
>>>> missing some emails from the weekend when first turning on his 
>>>> desktop.
>>>> I know of no way to discover if he's deleted and then purged email 
>>>> from
>>>> his mailbox using imap clients. I've checked the logs and he does not
>>>> access his mailbox simultaneously from any of the 3 clients.
>>>>
>>>> I can find 31 emails he received since his last pop login on Friday
>>>> until his first pop login on Monday. The pop login indicates he 
>>>> received
>>>> only 27 emails during the pop retrieval.
>>>>
>>>> I'm a little lost here. Any help would be appreciated in interpreting
>>>> the logs or suggesting how this might have happened.
>>>>
>>>> thanks
>>>>
>>>> steve campbell
>>>
>>> This probably doesn't help with the current case but for the future
>>> you could enable mail_log plugin to log several user events:
>>>
>>> http://wiki2.dovecot.org/Plugins/MailLog
>>
>> thanks very much. That looks great.
>>
>> Is there any particular file I should place the particular lines?
>>
>> steve
>
> For dovecot 2.x.x
>
> conf.d/20-imap.conf: add mail_log and notify to mail_plugins
>
> mail_plugins = $mail_plugins mail_log notify
>
>
> conf.d/10-logging.conf: There is already a template, just uncomment 
> and modify as needed.
>
> # mail_log plugin provides more event logging for mail processes.
> plugin {
>   # Events to log. Also available: flag_change append
>   #mail_log_events = delete undelete expunge copy mailbox_delete 
> mailbox_rename
>   # Available fields: uid, box, msgid, from, subject, size, vsize, flags
>   # size and vsize are available only for expunge and copy events.
>   #mail_log_fields = uid box msgid size
> }

I found the 10-logging.conf file, but wasn't sure where to put the 
"mail_plugins" line.

Thanks very much for the help.

My setup is as follows:

# 2.0.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-220.el6.x86_64 x86_64 CentOS release 6.2 (Final)
disable_plaintext_auth = no
listen = *
mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u
mbox_write_locks = fcntl
namespace {
   hidden = yes
   inbox = yes
   list = yes
   location = mbox:~/mail:INBOX=/var/spool/mail/%u
   prefix =
   separator = /
   type = private
}
namespace {
   hidden = yes
   list = no
   location = mbox:~/mail:INBOX=/var/spool/mail/%u
   prefix = "#mbox/"
   separator = /
   type = private
}
namespace {
   hidden = yes
   list = no
   location =
   prefix = mail/
   separator = /
   type = private
}
namespace {
   hidden = yes
   list = no
   location = mbox:~/mail:INBOX=/var/spool/mail/%u
   prefix = ~/mail/
   separator = /
   type = private
}
namespace {
   hidden = yes
   list = no
   location =
   prefix = ~%u/mail/
   separator = /
   type = private
}
passdb {
   driver = pam
}
plugin {
   mail_log_events = delete undelete expunge copy mailbox_delete 
mailbox_rename
   mail_log_fields = uid box msgid size
}
protocols = imap pop3
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_key = </etc/pki/dovecot/private/dovecot.pem
userdb {
   driver = passwd
}
protocol imap {
   mail_plugins = " mail_log notify"
}
protocol pop3 {
   pop3_uidl_format = %08Xu%08Xv
}


The line for mail_plugs shows the space before the "mail_log notify" 
part, but it seems to be working. I guess one day I need to clean up 
those namespaces, since I basic only use one of them.

One day, I hope I can learn what all I need to know about dovecot as well.

Thanks for all the gracious help.

steve