On 24.9.2012, at 14.27, Ralf Hildebrandt wrote:
> A user is logged in via imap from multiple devices.
> The log has this:
>
> Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX,
> uid=15347, msgid=<1341851741.4ffb085d2e2b7@swift.generated>, size=15675
> Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX,
> uid=15739,
> msgid=<b23b2e42f6ae9ba1602690be42b7b5c7.squir...@webmail.charite.de>,
> size=18134
> Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX,
> uid=15740,
> msgid=<3509d8b3f9054c4bb26c85f3e4b96563036822877...@exchange21.charite.de>,
> size=22226
> Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX,
> uid=15741, msgid=<c2e306f4-8622-4d0f-98bd-c67f31f2f...@charite.de>, size=5160
>
> How can I find out WHICH CLIENT caused the deletion?
Change mail_log_prefix to include %{session} (and maybe %r for IP).
> Same issue:
>
> Sep 21 09:36:05 postamt dovecot: imap-login: Login: user=<awxxxxer>,
> method=PLAIN, rip=109.45.0.37, lip=141.42.206.36, mpid=30773, TLS,
> session=<e8TfSjHKgwBtLQAl>
> Sep 21 10:06:17 postamt dovecot: imap(awxxxxer): Disconnected for inactivity
> in=2255 out=4398
>
> How can I be sure that the log entry from 10:06:17 "belongs" to the
> log entry from "09:36:05"? Also, what is the meaning of the
> "session=<e8TfSjHKgwBtLQAl>"?
This is also solved with mail_log_prefix change. The session's idea is exactly
to match the same session's log messages together. It's a string guaranteed to
be unique for the next .. was it 7 years or so.
