Re: [Dovecot] Couple of questions about the logs

[e-frog]

On 23.07.2012 18:07, wrote Steve Campbell:

On 7/23/2012 11:54 AM, e-frog wrote:
On 23.07.2012 17:31, wrote Steve Campbell:
The log entries for imap disconnection shows a "bytes = x/y" format
where the x equals bytes sent from client and y equals bytes received
from client.

Can someone explain that a little better to me, please? In an imap
account, does this "y" represent the size of the header information
being returned to the client or the amount of data of the email mailbox?

Also, is there a way to tell if an email has been deleted (or marked for
deletion) when using an imap client?

Here's the situation:

I've got a user who uses imap when using his phone and webmail. When in
the office, he uses a pop3 client on his desktop. He indicates he's
missing some emails from the weekend when first turning on his desktop.
I know of no way to discover if he's deleted and then purged email from
his mailbox using imap clients. I've checked the logs and he does not
access his mailbox simultaneously from any of the 3 clients.

I can find 31 emails he received since his last pop login on Friday
until his first pop login on Monday. The pop login indicates he received
only 27 emails during the pop retrieval.

I'm a little lost here. Any help would be appreciated in interpreting
the logs or suggesting how this might have happened.

thanks

steve campbell

This probably doesn't help with the current case but for the future
you could enable mail_log plugin to log several user events:

http://wiki2.dovecot.org/Plugins/MailLog

thanks very much. That looks great.

Is there any particular file I should place the particular lines?

steve

For dovecot 2.x.x

conf.d/20-imap.conf: add mail_log and notify to mail_plugins

mail_plugins = $mail_plugins mail_log notify


conf.d/10-logging.conf: There is already a template, just uncomment and 
modify as needed.

# mail_log plugin provides more event logging for mail processes.
plugin {
  # Events to log. Also available: flag_change append
  #mail_log_events = delete undelete expunge copy mailbox_delete 
mailbox_rename
  # Available fields: uid, box, msgid, from, subject, size, vsize, flags
  # size and vsize are available only for expunge and copy events.
  #mail_log_fields = uid box msgid size
}