How to enable the Dovecot mail-log plugin

Introduction

You may use the mail_log plugin to help diagnose issues with mail being uploaded and downloaded by email clients.

This plugin adds the ability to log the following additional events:

Setting and removing \Deleted flag
Expunging (includes autoexpunge)
Copying mails to another mailbox
Mailbox creations
Mailbox deletions
Mailbox renames
Any flag changes
Saves

Procedure

1. Login to the server via SSH or Terminal as the root user
2. Check to see if a local template already exists:

   stat /var/cpanel/templates/dovecot2.3/main.local

3. If one does not exist, create a local template to override the default Dovecot configuration template:

   cp -v /var/cpanel/templates/dovecot/main.{default,local}

4. Open the new local template with the text editor of your choice. The Vim text editor is used in the following example:

   vim /var/cpanel/templates/dovecot/main.local

5. Locate the start of the Imap protocol section, which looks like this:

   ##
   ## IMAP specific settings
   ##
   
   protocol imap {

6. Within the IMAP protocol section, locate the mail_plugin directive. Do not remove the existing plugins. Add the mail_log and notify plugins before the $mail_plugins variable. The start of that line should look like the following, where '...' represents the rest of the plugins that already existed before your edit:

   mail_plugins = mail_log notify $mail_plugins ...

7. Locate the LMTP section, which starts with:

   ##
   ## LMTP specific settings
   ##
   
   protocol lmtp {

8. Add the mail_log and notify plugins to the mail_plugins directive, where "..." represents the already existing plugins from before your edit:

   mail_plugins = mail_log notify ...

9. Save the file.
10. Rebuild the dovecot configuration with the following command:

    /scripts/builddovecotconf

11. Restart Dovecot with the following command:

    /scripts/restartsrv_dovecot --restart

12. You may then examine the following log once actions such as mail deletion have taken place:

    /var/log/maillog

Note: You may also adjust the events that are recorded by locating and editing the mail_log_events directive and the mail_log_fields directive within /var/cpanel/templates/dovecot/main.local.

Additional Resources

cPanel Guide - How to disable the Dovecot mail-log plugin

Dovecot Docs - mail-log plugin

cPanel Docs - The dovecot.conf file