Problem enabling the mail_log plugin
I need to track some issues with deleted messages so I have been trying to set up the mail_log plugin. I have Dovecot v2..27 running on Debian 9. I have configured /etc/dovecot/conf.d/10-logging.conf, 20-imap.conf, and 20-lmtp.conf and restarted dovecot, but I see so difference in /var/log/mail.info & /var/log/syslog when I delete a message from my Inbox in Roundcube. Here is the abbreviated output from doveconf -n:
# 2.2.27 (): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 () # OS: Linux 4.9.0-14-amd64 x86_64 Debian 9.13 ext4
plugin { mail_log_events = delete undelete mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve }
protocols = " imap lmtp sieve pop3"
protocol lmtp { mail_plugins = " sieve notify mail_log" }
protocol imap { mail_max_userip_connections = 50 mail_plugins = " notify mail_log" }
What am I missing?
I have expunge in mail_log_events
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
Yassine
Le 2/8/21 à 5:03 AM, Mike Quigley a écrit :
I need to track some issues with deleted messages so I have been trying to set up the mail_log plugin. I have Dovecot v2..27 running on Debian 9. I have configured /etc/dovecot/conf.d/10-logging.conf, 20-imap.conf, and 20-lmtp.conf and restarted dovecot, but I see so difference in /var/log/mail.info & /var/log/syslog when I delete a message from my Inbox in Roundcube. Here is the abbreviated output from doveconf -n:
# 2.2.27 (): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 () # OS: Linux 4.9.0-14-amd64 x86_64 Debian 9.13 ext4
plugin { mail_log_events = delete undelete mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve }
protocols = " imap lmtp sieve pop3"
protocol lmtp { mail_plugins = " sieve notify mail_log" }
protocol imap { mail_max_userip_connections = 50 mail_plugins = " notify mail_log" }
What am I missing?
Le 2/9/21 à 11:41 AM, Yassine Chaouche a écrit :
I have expunge in mail_log_events
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
Yassine Oh yes and copy, because when you delete mail in roundcube it actually copies it to the trash then expunge it from where it was, so you should look after these two
Yassine.
I looked at the Trash messages on the Server (which is using Maildir) and they are flagged as :2,S (Seen) but not T (Trash). So it looks like when Roundcube copies them to Trash and expunges the original, it doesn't set the Trash flag on the message. If I manually delete the message from the Trash folder, then RC does set the Trash flag and that action will be logged to my Dovecot logs. I did not set the expunge & copy options in mail_log_events because I didn't want to fill up the logs with all that additional logging, thinking that delete would get me what I was looking for. Thanks for pointing me in the right direction.
On 2021-02-09 3:44 am, Yassine Chaouche wrote:
Le 2/9/21 à 11:41 AM, Yassine Chaouche a écrit :
I have expunge in mail_log_events
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
Yassine Oh yes and copy, because when you delete mail in roundcube it actually copies it to the trash then expunge it from where it was, so you should look after these two
Yassine.
On 09 Feb 2021, at 11:34, Mike Quigley mike@sierraai.com wrote:
So it looks like when Roundcube copies them to Trash and expunges the original, it doesn't set the Trash flag on the message.
Checking on my server none of the messages in the Trash maildir have a T flag, they all end in things like :2,hk or :2,Sab or :2,d (and probably other things as well).
-- Doctor inherits a castle (Young Frankenstein)
The default Debian 8 or 9 install of Dovecot duplicates Dovecot logging in both /var/log/mail.info & /var/log/syslog. This server was originally setup with v8 and later upgraded to v9.
On 2021-02-09 3:46 am, Yassine Chaouche wrote:
Le 2/8/21 à 5:03 AM, Mike Quigley a écrit : I see so difference in /var/log/mail.info & /var/log/syslog
Did you configure it to use syslog ? my config puts dovecot logs in /var/log/dovecot
Yassine.
participants (3)
-
＠lbutlr
-
Mike Quigley
-
Yassine Chaouche