Re: [SPAM: high] imap logging ?

[mancyb...@gmail.com]

Works wonders thank you!
Finally I can use my accusation finger with my users!
http://cdn.scooppick.com/wp-content/uploads/2015/03/Keeps-Talking.jpg


On Thu, 26 Nov 2015 08:52:55 +0100
Urban Loesch  wrote:

> Hi,
> 
> perhaps this is what you need.
> 
> http://wiki2.dovecot.org/Plugins/MailLog
> 
> No "mail_debug enabled" neccessary.
> 
> Regards
> Urban
> 
> Am 26.11.2015 um 07:51 schrieb mancyb...@gmail.com:
> > Hi I'm trying to log my users imap actions, like when creating a folder, 
> > moving an email or deleting an email.
> > So I've enabled 'mail_debug' and I'm checking /var/log/dovecot/debug.log
> > this is what happens when I delete an email:
> > 
> > Nov 26 07:46:38 auth-worker(1555): Debug: sql(XXX,127.0.0.1): query: SELECT 
> > password FROM mailbox WHERE username = 'XXX' and active = 1 and 
> > restrictedAccess = 0
> > Nov 26 07:46:38 auth: Debug: client out: OK 1   user=XXX
> > Nov 26 07:46:38 auth-worker(1555): Debug: sql(XXX,127.0.0.1): SELECT 
> > '/var/vmail/XXX/XXX' as home, 5000 AS uid, 5000 AS gid, 
> > concat('*:storage=', quota) AS quota_rule FROM mailbox WHERE username = 
> > 'XXX'
> > Nov 26 07:46:38 auth: Debug: master out: USER   374472705   XXX 
> > home=/var/vmail/XXX/XXX uid=5000gid=5000
> > quota_rule=*:storage=524288
> > Nov 26 07:46:38 imap(XXX): Debug: Effective uid=5000, gid=5000, 
> > home=/var/vmail/XXX/XXX
> > Nov 26 07:46:38 imap(XXX): Debug: Quota root: name=User quota 
> > backend=maildir args=
> > Nov 26 07:46:38 imap(XXX): Debug: Quota rule: root=User quota mailbox=* 
> > bytes=536870912 messages=0
> > Nov 26 07:46:38 imap(XXX): Debug: Quota rule: root=User quota mailbox=Trash 
> > bytes=+104857600 messages=0
> > Nov 26 07:46:38 imap(XXX): Debug: maildir++: 
> > root=/var/vmail/XXX/XXX/Maildir, index=/var/vmail/XXX/XXX/Maildir/indexes, 
> > control=, inbox=/var/vmail/XXX/XXX/Maildir, alt=
> > 
> > and when creating a folder, access an email or moving an email, the output 
> > is basically the same:
> > I'm unable to find the actual IMAP command.
> > 
> > So, question: is there a way to log IMAP commands to a file ?
> > 
> > Thank you,
> > Mike
> > 

Re: [SPAM: high] imap logging ?

[Urban Loesch]

Hi,

perhaps this is what you need.

http://wiki2.dovecot.org/Plugins/MailLog

No "mail_debug enabled" neccessary.

Regards
Urban

Am 26.11.2015 um 07:51 schrieb mancyb...@gmail.com:
> Hi I'm trying to log my users imap actions, like when creating a folder, 
> moving an email or deleting an email.
> So I've enabled 'mail_debug' and I'm checking /var/log/dovecot/debug.log
> this is what happens when I delete an email:
> 
> Nov 26 07:46:38 auth-worker(1555): Debug: sql(XXX,127.0.0.1): query: SELECT 
> password FROM mailbox WHERE username = 'XXX' and active = 1 and 
> restrictedAccess = 0
> Nov 26 07:46:38 auth: Debug: client out: OK   1   user=XXX
> Nov 26 07:46:38 auth-worker(1555): Debug: sql(XXX,127.0.0.1): SELECT 
> '/var/vmail/XXX/XXX' as home, 5000 AS uid, 5000 AS gid, concat('*:storage=', 
> quota) AS quota_rule FROM mailbox WHERE username = 'XXX'
> Nov 26 07:46:38 auth: Debug: master out: USER 374472705   XXX 
> home=/var/vmail/XXX/XXX uid=5000gid=5000
> quota_rule=*:storage=524288
> Nov 26 07:46:38 imap(XXX): Debug: Effective uid=5000, gid=5000, 
> home=/var/vmail/XXX/XXX
> Nov 26 07:46:38 imap(XXX): Debug: Quota root: name=User quota backend=maildir 
> args=
> Nov 26 07:46:38 imap(XXX): Debug: Quota rule: root=User quota mailbox=* 
> bytes=536870912 messages=0
> Nov 26 07:46:38 imap(XXX): Debug: Quota rule: root=User quota mailbox=Trash 
> bytes=+104857600 messages=0
> Nov 26 07:46:38 imap(XXX): Debug: maildir++: root=/var/vmail/XXX/XXX/Maildir, 
> index=/var/vmail/XXX/XXX/Maildir/indexes, control=, 
> inbox=/var/vmail/XXX/XXX/Maildir, alt=
> 
> and when creating a folder, access an email or moving an email, the output is 
> basically the same:
> I'm unable to find the actual IMAP command.
> 
> So, question: is there a way to log IMAP commands to a file ?
> 
> Thank you,
> Mike
> 

imap logging ?

[mancyb...@gmail.com]

Hi I'm trying to log my users imap actions, like when creating a folder, moving 
an email or deleting an email.
So I've enabled 'mail_debug' and I'm checking /var/log/dovecot/debug.log
this is what happens when I delete an email:

Nov 26 07:46:38 auth-worker(1555): Debug: sql(XXX,127.0.0.1): query: SELECT 
password FROM mailbox WHERE username = 'XXX' and active = 1 and 
restrictedAccess = 0
Nov 26 07:46:38 auth: Debug: client out: OK 1   user=XXX
Nov 26 07:46:38 auth-worker(1555): Debug: sql(XXX,127.0.0.1): SELECT 
'/var/vmail/XXX/XXX' as home, 5000 AS uid, 5000 AS gid, concat('*:storage=', 
quota) AS quota_rule FROM mailbox WHERE username = 'XXX'
Nov 26 07:46:38 auth: Debug: master out: USER   374472705   XXX 
home=/var/vmail/XXX/XXX uid=5000gid=5000
quota_rule=*:storage=524288
Nov 26 07:46:38 imap(XXX): Debug: Effective uid=5000, gid=5000, 
home=/var/vmail/XXX/XXX
Nov 26 07:46:38 imap(XXX): Debug: Quota root: name=User quota backend=maildir 
args=
Nov 26 07:46:38 imap(XXX): Debug: Quota rule: root=User quota mailbox=* 
bytes=536870912 messages=0
Nov 26 07:46:38 imap(XXX): Debug: Quota rule: root=User quota mailbox=Trash 
bytes=+104857600 messages=0
Nov 26 07:46:38 imap(XXX): Debug: maildir++: root=/var/vmail/XXX/XXX/Maildir, 
index=/var/vmail/XXX/XXX/Maildir/indexes, control=, 
inbox=/var/vmail/XXX/XXX/Maildir, alt=

and when creating a folder, access an email or moving an email, the output is 
basically the same:
I'm unable to find the actual IMAP command.

So, question: is there a way to log IMAP commands to a file ?

Thank you,
Mike

Re: IMAP logging / rawlog

[Timo Sirainen]

On 04 Apr 2015, at 02:58, G H uothr...@yahoo.com wrote:
 
 I am trying to monitor with Nagios that my phones are consistently checking 
 into dovecot via IMAP. I used to be able to parse syslog for imap-login 
 messages. I have since updated my phones, the phoness email client (k9-mail) 
 and dovecot. Now the imap-login messages are few and far between. However, I 
 can clearly see via tcpdump that some traffic is happening when I click 
 refresh on k9. I enabled rawlog support in dovecot, but it doesn't seem to 
 write to disc frequently enough.
 
 
 1) Does anyone have a better suggestion for how to monitor that my phone is 
 checking in regularly?

Writing a plugin would be the cleanest way to do this..

 2) Is there a flush-to-disk capability for rawlog in dovecot?

It was behaving like that before v2.2.14 started optimizing the rawlog writes 
by buffering them. I added now code to flush the rawlog every second: 
http://hg.dovecot.org/dovecot-2.2/rev/ee001c131952

 3) Also, when you have imap_zlib plugin enabled, the rawlog logs the raw 
 compressed data instead of the decompressed IMAP commands. Is this an 
 oversight?

The way it's currently implemented it can't work otherwise. That's why there is 
doveadm dump -t imapzlib raw.log command to decode it.

It would be possible to implement rawlog differently also by having the imap 
processes write them directly, but this would require more development. This is 
actually how imap-login -R parameter also does rawlogging. (I think it only 
does pre-login rawlogging, but you could see if it happens to be writing 
post-login rawlog as well.)

IMAP logging / rawlog

[G H]

I am trying to monitor with Nagios that my phones are consistently checking 
into dovecot via IMAP. I used to be able to parse syslog for imap-login 
messages. I have since updated my phones, the phoness email client (k9-mail) 
and dovecot. Now the imap-login messages are few and far between. However, I 
can clearly see via tcpdump that some traffic is happening when I click refresh 
on k9. I enabled rawlog support in dovecot, but it doesn't seem to write to 
disc frequently enough.


1) Does anyone have a better suggestion for how to monitor that my phone is 
checking in regularly?
2) Is there a flush-to-disk capability for rawlog in dovecot?
3) Also, when you have imap_zlib plugin enabled, the rawlog logs the raw 
compressed data instead of the decompressed IMAP commands. Is this an oversight?

(FYI: k9 is calling SELECT INBOX on refresh)


Thanks,
G H

Re: [Dovecot] Imap logging and inetd

[Timo Sirainen]

On Tue, 2008-12-02 at 13:48 -0500, Jonathan Siegle wrote:
 Jonathan Siegle said the following on 12/2/08 7:16 AM:
  When I ran /usr/local/sbin/dovecot, the variable 
  login_log_format_elements from dovecot.conf was honored. Now when I run 
  /usr/local/libexec/dovecot/imap-login from /etc/inetd.conf, it isn't. 
  How do I get imap-login to write log lines that use 
  login_log_format_elements for the format?
  
  
  This is dovecot-1.2.alpha3 soon to be alpha4.
  
  Thanks,
  Jonathan
 I found where to get my desired result in src/master/mail-process.c.

Huh? mail-process.c only affects post-login imap/pop3. What did you
change?



signature.asc
Description: This is a digitally signed message part

Re: [Dovecot] Imap logging and inetd

[Jonathan Siegle]

On Dec 13, 2008, at 10:54 PM, Timo Sirainen wrote:


On Tue, 2008-12-02 at 13:48 -0500, Jonathan Siegle wrote:

Jonathan Siegle said the following on 12/2/08 7:16 AM:

When I ran /usr/local/sbin/dovecot, the variable
login_log_format_elements from dovecot.conf was honored. Now when  
I run
/usr/local/libexec/dovecot/imap-login from /etc/inetd.conf, it  
isn't.

How do I get imap-login to write log lines that use
login_log_format_elements for the format?


This is dovecot-1.2.alpha3 soon to be alpha4.

Thanks,
Jonathan

I found where to get my desired result in src/master/mail-process.c.


Huh? mail-process.c only affects post-login imap/pop3. What did you
change?

The goal was to print a line with the user and the IP address with a  
date/time stamp. So I send those to syslog from here. Is that bad  
information? I haven't gotten bad info from it yet..


-Jonathan

smime.p7s
Description: S/MIME cryptographic signature

Re: [Dovecot] Imap logging and inetd

[Timo Sirainen]

On Sat, 2008-12-13 at 23:06 -0500, Jonathan Siegle wrote:
 On Dec 13, 2008, at 10:54 PM, Timo Sirainen wrote:
 
  On Tue, 2008-12-02 at 13:48 -0500, Jonathan Siegle wrote:
  Jonathan Siegle said the following on 12/2/08 7:16 AM:
When I ran /usr/local/sbin/dovecot, the variable
  login_log_format_elements from dovecot.conf was honored. Now when  
  I run
  /usr/local/libexec/dovecot/imap-login from /etc/inetd.conf, it  
  isn't.
  How do I get imap-login to write log lines that use
  login_log_format_elements for the format?
 
 
  This is dovecot-1.2.alpha3 soon to be alpha4.
 
  Thanks,
  Jonathan
  I found where to get my desired result in src/master/mail-process.c.
 
  Huh? mail-process.c only affects post-login imap/pop3. What did you
  change?
 
 The goal was to print a line with the user and the IP address with a  
 date/time stamp. So I send those to syslog from here. Is that bad  
 information? I haven't gotten bad info from it yet..

Oh, I guess that'll work. Anyway the problem isn't about ignoring any
settings. It's that when running via inetd it logs to stderr. In my
system that gets logged to /var/log/syslog.


signature.asc
Description: This is a digitally signed message part

[Dovecot] Imap logging and inetd

[Jonathan Siegle]

	When I ran /usr/local/sbin/dovecot, the variable 
login_log_format_elements from dovecot.conf was honored. Now when I run 
/usr/local/libexec/dovecot/imap-login from /etc/inetd.conf, it isn't. 
How do I get imap-login to write log lines that use 
login_log_format_elements for the format?



This is dovecot-1.2.alpha3 soon to be alpha4.

Thanks,
Jonathan


smime.p7s
Description: S/MIME Cryptographic Signature

Re: [Dovecot] Imap logging and inetd

[Jonathan Siegle]

Jonathan Siegle said the following on 12/2/08 7:16 AM:
	When I ran /usr/local/sbin/dovecot, the variable 
login_log_format_elements from dovecot.conf was honored. Now when I run 
/usr/local/libexec/dovecot/imap-login from /etc/inetd.conf, it isn't. 
How do I get imap-login to write log lines that use 
login_log_format_elements for the format?



This is dovecot-1.2.alpha3 soon to be alpha4.

Thanks,
Jonathan

I found where to get my desired result in src/master/mail-process.c.

-Jonathan


smime.p7s
Description: S/MIME Cryptographic Signature

Re: [Dovecot] verbose IMAP logging

[Timo Sirainen]

On Thu, 2008-02-14 at 20:54 -0800, Robert Chien wrote:
 Hi,
 
 Is there a way to enable telemetry or debug-level logging in Dovecot  
 IMAP, to see the exact IMAP command issued by the client and server?  
 E.g. to confirm if a certain MUA is indeed using IMAP IDLE, or if  
 it's doing LIST or LSUB.
 
 The IMAP connection is made over TLS/SSL, so tcpdump won't work.

rawlog. http://dovecot.org/bugreport.html#sniffing



signature.asc
Description: This is a digitally signed message part