How to enable Dovecot's rawlog to track mail client actions

Introduction

Sometimes you may have an issue where a message is moved to another folder, and no filter was triggered. You can enable Dovecot's rawlog to enable extended logging to determine what's responsible for these changes.

Note: Raw logging in Dovecot should only be enabled temporarily. As soon as you're done troubleshooting an e-mail account the rawlog directory and local template file should be removed, and the Dovecot configuration rebuilt and Dovecot restarted.

Procedure

The first thing you will need to do is make a local template for the Dovecot configuration file to add the configuration options:

[root@server]# cp -v /var/cpanel/templates/dovecot2.3/main.{default,local}
‘/var/cpanel/templates/dovecot2.3/main.default’ -> ‘/var/cpanel/templates/dovecot2.3/main.local’

Then add the rawlog_dir option to the imap protocol section of the /var/cpanel/templates/dovecot2.3/main.local file:

protocol imap {

# If nothing happens for this long while client is IDLEing, move the connection
# to imap-hibernate process and close the old imap process. This saves memory,
# because connections use very little memory in imap-hibernate process. The
# downside is that recreating the imap process back uses some resources.

[% IF imap_hibernate_timeout %]
imap_hibernate_timeout = [% imap_hibernate_timeout %]s
[% END %]

rawlog_dir = %h/rawlog

After making these changes the Dovecot configuration needs to be rebuilt and the service restarted:

[root@server]# /scripts/builddovecotconf
info [builddovecotconf] 'local' template in use (/var/cpanel/templates/dovecot2.3/main.local)
info [builddovecotconf] 'local' template in use (/var/cpanel/templates/dovecot2.3/main.local)

[root@server]# /scripts/restartsrv_dovecot
Waiting for "dovecot" to restart ………waiting for "dovecot" to initialize ………finished.

Service Status
dovecot (/usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf) is running as root with PID 855790 (systemd+/proc check method).

Startup Log
Jan 27 02:18:34 hostname.example.com systemd[1]: Started Dovecot Imap Server.
Jan 27 02:18:34 hostname.example.com dovecot[855790]: master: Dovecot v2.3.10.1 (a3d0e1171) starting up for lmtp, imap, pop3 (core dumps disabled)
Log Messages

Jan 27 02:18:34 hostname dovecot: master: Dovecot v2.3.10.1 (a3d0e1171) starting up for lmtp, imap, pop3 (core dumps disabled)
Jan 27 02:18:33 hostname dovecot: master: Warning: Killed with signal 15 (by pid=855784 uid=0 code=kill)
Jan 27 02:18:03 server2 dovecot: imap(cpanel-ccs)<855773><Rsn2aN25ZIt/AAAB>: Logged out in=50, out=870, bytes=50/870
Jan 27 02:18:03 hostname dovecot: imap-login: Login: user=<cpanel-ccs>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=855773, TLS, session=<Rsn2aN25ZIt/AAAB>
Jan 27 02:17:50 hostname dovecot: imap(sean@sean.com)<855769><Miw1aN259Nx/AAAB>: Logged out in=50, out=599, bytes=50/599

dovecot restarted successfully.

With rawlog_dir enabled, Dovecot will log extended details for each IMAP transaction if the rawlog directory exists in the user's home directory. In the scope of an e-mail account, the home directory would be /home/$USERNAME/mail/$DOMAIN/$EMAIL_ACCOUNT/. After creating the rawlog directory, you will need to make sure the folder is owned by the user so Dovecot can write to the folder. To do so, run this command, replacing $USER with the cPanel account that owns the domain:

chown $USER: rawlog

Once raw logging is enabled, you will see files that look similar to these:

• 20210127-020554.855175.1.in
• 20210127-020554.855175.1.out

Here is an example of a message being moved to the spam folder:

[root@server]# cat 20210127-020554.855175.1.in
1611734754.294985 A0003 STATUS INBOX (MESSAGES UNSEEN)
1611734754.296629 A0004 SELECT INBOX
1611734754.297159 A0005 UID SEARCH 1
1611734754.298735 A0006 UID MOVE 2 INBOX.spam
1611734754.308539 A0007 STATUS INBOX (MESSAGES UNSEEN)
1611734754.308816 A0008 STATUS INBOX.spam (MESSAGES UNSEEN)
1611734754.309072 A0009 GETQUOTAROOT INBOX
1611734754.317629 A0010 LOGOUT1611734754.317629 A0010 LOGOUT