How do I enable the Dovecot mail_log plugin?

Question

How do I enable the Dovecot mail_log plugin?

Answer

You may use the mail_log plugin to diagnose issues with mail being uploaded and downloaded by email clients. This plugin adds the ability to log the following mail events:

• Setting and removing \Deleted flag
• Expunging (includes autoexpunge)
• Copying mails
• Saves
• Mailbox creations
• Mailbox deletions
• Mailbox renames
• Any flag changes

1. Log in to the server via SSH or WHM Terminal as the root user

2. Check to see if a local template already exists:

   # stat /var/cpanel/templates/dovecot/main.local

   Note: Skip step 3 if the main.local already exists

3. If one does not exist, create a local template to override the default Dovecot configuration template:

   # cp -v /var/cpanel/templates/dovecot/main.{default,local}

4. Run the following command to enable the notify and mail_log plugins in the IMAP context. The mail_log plugin requires notify, so they must be enabled together.

   # sed -i 's#\[% protocol_imap\.mail_plugins %\]#& notify mail_log#' /var/cpanel/templates/dovecot/main.local

5. Run the next command to enable event logging in the IMAP context. By default, this command will enable all events to be logged.

   # grep -q 'mail_log_events' /var/cpanel/templates/dovecot/main.local || sed -i '/^protocol imap {/a\
   mail_log_events = delete undelete expunge save copy mailbox_create mailbox_delete mailbox_rename flag_change\
   mail_log_fields = uid box msgid size from\
   mail_log_cached_only = no
   ' /var/cpanel/templates/dovecot/main.local

6. Rebuild the dovecot configuration with the following command:

   # /scripts/builddovecotconf

7. Restart Dovecot with the following command:

   # /scripts/restartsrv_dovecot --restart

8. You may then examine the following log once actions such as mail deletion have taken place:

   # tail -f /var/log/maillog

Note: You may also adjust the recorded events by locating and editing the mail_log_events directive and the mail_log_fields directive within /var/cpanel/templates/dovecot/main.local.

Additional Resources

cPanel Guide - How to disable the Dovecot mail-log plugin

Dovecot Docs - mail-log plugin

cPanel Docs - The dovecot.conf file