On 7/23/2012 11:54 AM, e-frog wrote:

On 23.07.2012 17:31, wrote Steve Campbell:

...

The log entries for imap disconnection shows a "bytes = x/y" format where the x equals bytes sent from client and y equals bytes received from client.

Can someone explain that a little better to me, please? In an imap account, does this "y" represent the size of the header information being returned to the client or the amount of data of the email mailbox?

Also, is there a way to tell if an email has been deleted (or marked for deletion) when using an imap client?

Here's the situation:

I've got a user who uses imap when using his phone and webmail. When in the office, he uses a pop3 client on his desktop. He indicates he's missing some emails from the weekend when first turning on his desktop. I know of no way to discover if he's deleted and then purged email from his mailbox using imap clients. I've checked the logs and he does not access his mailbox simultaneously from any of the 3 clients.

I can find 31 emails he received since his last pop login on Friday until his first pop login on Monday. The pop login indicates he received only 27 emails during the pop retrieval.

I'm a little lost here. Any help would be appreciated in interpreting the logs or suggesting how this might have happened.

thanks

steve campbell

This probably doesn't help with the current case but for the future you could enable mail_log plugin to log several user events:

http://wiki2.dovecot.org/Plugins/MailLog

thanks very much. That looks great.

Is there any particular file I should place the particular lines?

steve

On 7/23/2012 12:23 PM, e-frog wrote:

On 23.07.2012 18:07, wrote Steve Campbell:

...

On 7/23/2012 11:54 AM, e-frog wrote:

...

On 23.07.2012 17:31, wrote Steve Campbell:

...

The log entries for imap disconnection shows a "bytes = x/y" format where the x equals bytes sent from client and y equals bytes received from client.

Can someone explain that a little better to me, please? In an imap account, does this "y" represent the size of the header information being returned to the client or the amount of data of the email mailbox?

Also, is there a way to tell if an email has been deleted (or marked for deletion) when using an imap client?

Here's the situation:

I've got a user who uses imap when using his phone and webmail. When in the office, he uses a pop3 client on his desktop. He indicates he's missing some emails from the weekend when first turning on his desktop. I know of no way to discover if he's deleted and then purged email from his mailbox using imap clients. I've checked the logs and he does not access his mailbox simultaneously from any of the 3 clients.

I can find 31 emails he received since his last pop login on Friday until his first pop login on Monday. The pop login indicates he received only 27 emails during the pop retrieval.

I'm a little lost here. Any help would be appreciated in interpreting the logs or suggesting how this might have happened.

thanks

steve campbell

This probably doesn't help with the current case but for the future you could enable mail_log plugin to log several user events:

http://wiki2.dovecot.org/Plugins/MailLog

thanks very much. That looks great.

Is there any particular file I should place the particular lines?

steve

For dovecot 2.x.x

conf.d/20-imap.conf: add mail_log and notify to mail_plugins

mail_plugins = $mail_plugins mail_log notify

conf.d/10-logging.conf: There is already a template, just uncomment and modify as needed.

# mail_log plugin provides more event logging for mail processes. plugin { # Events to log. Also available: flag_change append #mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename # Available fields: uid, box, msgid, from, subject, size, vsize, flags # size and vsize are available only for expunge and copy events. #mail_log_fields = uid box msgid size }

I found the 10-logging.conf file, but wasn't sure where to put the "mail_plugins" line.

Thanks very much for the help.

My setup is as follows:

# 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-220.el6.x86_64 x86_64 CentOS release 6.2 (Final) disable_plaintext_auth = no listen = * mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mbox_write_locks = fcntl namespace { hidden = yes inbox = yes list = yes location = mbox:~/mail:INBOX=/var/spool/mail/%u prefix = separator = / type = private } namespace { hidden = yes list = no location = mbox:~/mail:INBOX=/var/spool/mail/%u prefix = "#mbox/" separator = / type = private } namespace { hidden = yes list = no location = prefix = mail/ separator = / type = private } namespace { hidden = yes list = no location = mbox:~/mail:INBOX=/var/spool/mail/%u prefix = ~/mail/ separator = / type = private } namespace { hidden = yes list = no location = prefix = ~%u/mail/ separator = / type = private } passdb { driver = pam } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } protocols = imap pop3 ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } protocol imap { mail_plugins = " mail_log notify" } protocol pop3 { pop3_uidl_format = %08Xu%08Xv }

The line for mail_plugs shows the space before the "mail_log notify" part, but it seems to be working. I guess one day I need to clean up those namespaces, since I basic only use one of them.

One day, I hope I can learn what all I need to know about dovecot as well.

Thanks for all the gracious help.

steve