I made some changes to the source of version 1.2.11 to allow for client IP logging on disconnects and deleted (expunged) message count logging in imap on disconnects. If this looks viable I have included the patch below.

diff -crB dovecot-1.2.11.orig/src/imap/client.c dovecot-1.2.11/src/imap/client.c *** dovecot-1.2.11.orig/src/imap/client.c 2010-01-24 16:14:17.000000000 -0700 --- dovecot-1.2.11/src/imap/client.c 2010-05-19 15:30:42.070401074 -0600

*** 42,47 **** --- 42,48 ---- client->fd_out = fd_out; client->input = i_stream_create_fd(fd_in, imap_max_line_length, FALSE); client->output = o_stream_create_fd(fd_out, (size_t)-1, FALSE);

• client->expunged = 0;

  o_stream_set_flush_callback(client->output, client_output, client);

*** 105,110 **** --- 106,113 ---- static struct var_expand_table static_tab[] = { { 'i', NULL, "input" }, { 'o', NULL, "output" },

•   { 'h', NULL, "host" },

•   { 'd', NULL, "deleted_count" },
    { '\0', NULL, NULL }

  }; struct var_expand_table *tab;

*** 115,120 **** --- 118,125 ----

tab[0].value = dec2str(client->input->v_offset);
tab[1].value = dec2str(client->output->offset);

• tab[2].value = getenv("IP") ? getenv("IP") : "Unknown";

• tab[3].value = dec2str(client->expunged);

  str = t_str_new(128); var_expand(str, logout_format, tab); diff -crB dovecot-1.2.11.orig/src/imap/client.h dovecot-1.2.11/src/imap/client.h *** dovecot-1.2.11.orig/src/imap/client.h 2009-06-26 22:49:34.000000000 -0600 --- dovecot-1.2.11/src/imap/client.h 2010-05-19 15:29:17.317881992 -0600

*** 133,138 **** --- 133,139 ---- unsigned int destroyed:1; unsigned int handling_input:1; unsigned int syncing:1;

• unsigned int expunged; unsigned int id_logged:1; unsigned int mailbox_examined:1; unsigned int input_skip_line:1; /* skip all the data until we've diff -crB dovecot-1.2.11.orig/src/imap/cmd-close.c dovecot-1.2.11/src/imap/cmd-close.c *** dovecot-1.2.11.orig/src/imap/cmd-close.c 2010-01-24 16:14:17.000000000 -0700 --- dovecot-1.2.11/src/imap/cmd-close.c 2010-05-19 15:32:01.120410917 -0600

*** 18,24 **** client->mailbox = NULL;

storage = mailbox_get_storage(mailbox);

! if ((ret = imap_expunge(mailbox, NULL)) < 0) client_send_untagged_storage_error(client, storage); if (mailbox_sync(mailbox, 0, 0, NULL) < 0) client_send_untagged_storage_error(client, storage); --- 18,24 ---- client->mailbox = NULL;

storage = mailbox_get_storage(mailbox);

! if ((ret = imap_expunge(client, NULL)) < 0) client_send_untagged_storage_error(client, storage); if (mailbox_sync(mailbox, 0, 0, NULL) < 0) client_send_untagged_storage_error(client, storage); diff -crB dovecot-1.2.11.orig/src/imap/cmd-expunge.c dovecot-1.2.11/src/imap/cmd-expunge.c *** dovecot-1.2.11.orig/src/imap/cmd-expunge.c 2010-01-24 16:14:17.000000000 -0700 --- dovecot-1.2.11/src/imap/cmd-expunge.c 2010-05-19 15:32:18.120403801 -0600

*** 24,30 **** { struct client *client = cmd->client;

! if (imap_expunge(client->mailbox, search_args == NULL ? NULL : search_args->args) < 0) { client_send_storage_error(cmd, mailbox_get_storage(client->mailbox)); --- 24,30 ---- { struct client *client = cmd->client;

! if (imap_expunge(client, search_args == NULL ? NULL : search_args->args) < 0) { client_send_storage_error(cmd, mailbox_get_storage(client->mailbox)); diff -crB dovecot-1.2.11.orig/src/imap/imap-expunge.c dovecot-1.2.11/src/imap/imap-expunge.c *** dovecot-1.2.11.orig/src/imap/imap-expunge.c 2010-01-24 16:14:17.000000000 -0700 --- dovecot-1.2.11/src/imap/imap-expunge.c 2010-05-19 16:06:01.999843244 -0600

*** 5,18 **** #include "mail-search-build.h" #include "imap-expunge.h"

! int imap_expunge(struct mailbox *box, struct mail_search_arg *next_search_arg) { struct mail_search_context *ctx; struct mailbox_transaction_context *t; struct mail *mail; struct mail_search_args *search_args; bool expunges = FALSE;

if (mailbox_is_readonly(box)) {
	/* silently ignore */
	return 0;

--- 5,21 ---- #include "mail-search-build.h" #include "imap-expunge.h"

! int imap_expunge(struct client *client, struct mail_search_arg *next_search_arg) { struct mail_search_context *ctx; struct mailbox_transaction_context *t; struct mail *mail;

• struct mailbox *box; struct mail_search_args *search_args; bool expunges = FALSE;

• box = client->mailbox;

• if (mailbox_is_readonly(box)) { /* silently ignore */ return 0; diff -crB dovecot-1.2.11.orig/src/imap/imap-expunge.h dovecot-1.2.11/src/imap/imap-expunge.h *** dovecot-1.2.11.orig/src/imap/imap-expunge.h 2008-06-08 21:14:46.000000000 -0600 --- dovecot-1.2.11/src/imap/imap-expunge.h 2010-05-19 15:31:49.520410235 -0600

*** 3,8 ****

struct mail_search_arg;

! int imap_expunge(struct mailbox *box, struct mail_search_arg *next_search_arg);

#endif --- 3,8 ----

struct mail_search_arg;

! int imap_expunge(struct client *client, struct mail_search_arg *next_search_arg);

#endif diff -crB dovecot-1.2.11.orig/src/pop3/client.c dovecot-1.2.11/src/pop3/client.c *** dovecot-1.2.11.orig/src/pop3/client.c 2010-01-24 16:14:17.000000000 -0700 --- dovecot-1.2.11/src/pop3/client.c 2010-05-19 14:57:38.820402931 -0600

*** 238,243 **** --- 238,244 ---- { 's', NULL, "message_bytes" }, { 'i', NULL, "input" }, { 'o', NULL, "output" },

•   { 'h', NULL, "host" },
    { '\0', NULL, NULL }

  }; struct var_expand_table *tab;

*** 255,260 **** --- 256,262 ---- tab[6].value = dec2str(client->total_size); tab[7].value = dec2str(client->input->v_offset); tab[8].value = dec2str(client->output->offset);

• tab[9].value = getenv("IP") ? getenv("IP") : "Unknown";

  str = t_str_new(128); var_expand(str, logout_format, tab);

On Wed, May 19, 2010 at 10:39 AM, James Devine fxmulder@gmail.com wrote:

I am looking through the logging options and wondering if there are a couple of things that we can do

1. Logouts don't seem to show the IP address of the logout, we typically see multiple sessions at a time and wondering if there is a way to tie the logouts to an IP
2. POP logouts show the number of messages retrieved/deleted but I don't see a way to do this with IMAP, is there a logout option for this with imap?

Thanks