[Dovecot] Tracing an IP of a user who deleted the message

[Timo Sirainen]

On Thu, 2007-05-10 at 12:55 +0200, Steffen Kaiser wrote:
> > May 10 13:19:04 mailserver dovecot: IMAP(office): copy -> Trash: uid=1131, msgid=<45E669BE.8090705 at example.com>, box=Sent
> > May 10 13:19:05 mailserver dovecot: IMAP(office): deleted: uid=1131, msgid=<45E669BE.8090705 at example.com>, box=Sent
> > May 10 13:53:08 mailserver dovecot: IMAP(office): copy -> Trash: uid=1719, msgid=<002701b483f5$7aa257e0$23833bda at example.com>
> > May 10 13:53:08 mailserver dovecot: IMAP(office): deleted: uid=1719, msgid=<002701b483f5$7aa257e0$23833bda at example.com>
> >
> You can log the PID, too:
> 
> # Log prefix for mail processes. See doc/wiki/Variables.txt for list of
> # possible variables you can use.
> #mail_log_prefix = "%Us(%u): "
> mail_log_prefix = "%Us(%u) [%p]: "
> 
> Then you can trace the PID.

And if you just need the IP, even easier to add %r directly there :)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://dovecot.org/pipermail/dovecot/attachments/20070511/391a5fef/attachment-0001.pgp