How to enable the Dovecot mail-log plugin

Introduction

You may use the mail_log plugin to help diagnose issues with mail being uploaded and downloaded by email clients.

This plugin adds the ability to log the following additional events:

Setting and removing \Deleted flag
Expunging (includes autoexpunge)
Copying mails to another mailbox
Mailbox creations
Mailbox deletions
Mailbox renames
Any flag changes
Saves

Procedure

First, you will want to verify if a local template file already exists:

stat /var/cpanel/templates/dovecot2.3/main.default

If one does not exist, create a local template to override the default Dovecot configuration template:

cp -v /var/cpanel/templates/dovecot2.3/main.{default,local}

Next, save the following patch file to: /root/dovecot.patch

--- main.default    2019-06-21 22:05:20.149674248 -0500
+++ main.local  2019-08-06 22:11:51.530089808 -0500
@@ -767,7 +767,7 @@
 [% IF expire_trash %]
   mail_plugins = $mail_plugins expire
 [% END %]
-  mail_plugins = $mail_plugins zlib imap_zlib quota_clone virtual [% IF xaps_topic %]imap_xaps[% END %] [% IF fts_support %]fts fts_solr[% END %]
+  mail_plugins = $mail_plugins mail_log notify zlib imap_zlib quota_clone virtual [% IF xaps_topic %]imap_xaps[% END %] [% IF fts_support %]fts fts_solr[% END %]
   #mail_plugin_dir = /usr/lib/dovecot/imap
@@ -1338,10 +1338,10 @@
 # mail_log plugin provides more event logging for mail processes.
 plugin {
   # Events to log. Also available: flag_change append
-  #mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
+  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
   # Available fields: uid, box, msgid, from, subject, size, vsize, flags
   # size and vsize are available only for expunge and copy events.
-  #mail_log_fields = uid box msgid size
+  mail_log_fields = uid box msgid size
 }
 ##

Then, you will need to ssue the following command to patch the local template with the changes to enable the mail_log plugin:

patch -p1 /var/cpanel/templates/dovecot2.3/main.local < /root/dovecot.patch

Finally, rebuild the dovecot configuration from the local template that you just created, and then restart Dovecot:

/scripts/builddovecotconf && /scripts/restartsrv_dovecot

Once completed, you can tail the log:

tail -fn0 /var/log/maillog

Note: Enabling additional logging could cause log files to roll over sooner.

Resources

Dovecot Docs - mail-log plugin

cPanel Docs - The dovecot.conf file