rawlog binary

It works by checking if dovecot.rawlog/ directory exists in the logged in user's home directory, and writing the traffic to yyyymmdd-HHMMSS-pid.in and .out files. Each connection gets their own in/out files. Rawlog will simply skip users who don't have the dovecot.rawlog/ directory and the performance impact for those users is minimal.

On Wed, 30 Dec 2020 at 20:10, Marc Roos <M.Roos@f1-outsourcing.eu> wrote:

You know by any chance how to limit this only for one user?

-----Original Message-----
From: Odhiambo Washington [mailto:odhiambo@gmail.com]
Sent: 30 December 2020 18:00
To: dovecot
Subject: Re: import_environment = $import_environment DEBUG=1 where
should this be logged?

Hi Marc,

If you read the link keenly - Debugging/Rawlog - Dovecot Wiki
<https://wiki.dovecot.org/Debugging/Rawlog> - you will realize that you need to do some stuff.
I have done them and they produced the results.

Edit /path/to/dovecot/conf.d/10-master.conf and add the following:

Under this block:

add executable = imap postlogin to the block that has service imap {
....
...
}

Then create another block in the same file as follows:

service postlogin {
executable = script-login -d rawlog
unix_listener postlogin {
}
}

Identify the user for whom you want the rawlogs:

doveadm user -u technical@mydomain.name
userdb: technical@mydomain.name
user : technical@mydomain.name
home : /var/spool/virtual/mydomain.name/technical
uid : 26
gid : 26

Now do the following:
cd /var/spool/virtual/mydomain.name/technical
mkdir dovecot.rawlog
chown -R 26:26 dovecot.rawlog

systemctl restart dovecot (or however you do it in CentOS)

Now login to imap as the user .. perform some operations.

Now look inside
/var/spool/virtual/mydomain.name/technical/dovecot.rawlog/

PS: Adapt as necessary. I tested this on FreeBSD with dovecot- 2.3.11.3

Ignore the /tmp/rawlog/%u portion of the HOWTO. I did it too, but there
was nothing in /tmp/rawlog/ even though I created the directory and did
chmod 1777 /tmp/rawlog.

Adios.

On Wed, 30 Dec 2020 at 19:30, Marc Roos <M.Roos@f1-outsourcing.eu>
wrote:

You can also set DEBUG environment to have rawlog log an info
message
why it's not doing anything:
import_environment = $import_environment DEBUG=1

Where should this message appear, I also don't have this one.

[1]
https://wiki2.dovecot.org/Debugging/Rawlog

--

Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
"Oh, the cruft.", grep ^[^#] :-)