How to enable the Dovecot mail-log plugin

Introduction

You may use the mail_log plugin to help diagnose issues with mail being uploaded and downloaded by email clients.

This plugin adds the ability to log the following additional events:

Setting and removing \Deleted flag
Expunging (includes autoexpunge)
Copying mails to another mailbox
Mailbox creations
Mailbox deletions
Mailbox renames
Any flag changes
Saves

Procedure

Create a local template to override the default Dovecot configuration template:

cp -v /var/cpanel/templates/dovecot2.3/main.{default,local}

Save the following patch file to: /root/dovecot.patch

--- main.default 2019-06-21 22:05:20.149674248 -0500
+++ main.local 2019-08-06 22:11:51.530089808 -0500
@@ -767,7 +767,7 @@
[% IF expire_trash %]
mail_plugins = $mail_plugins expire
[% END %]
- mail_plugins = $mail_plugins zlib imap_zlib quota_clone virtual [% IF xaps_topic %]imap_xaps[% END %] [% IF fts_support %]fts fts_solr[% END %]
+ mail_plugins = $mail_plugins mail_log notify zlib imap_zlib quota_clone virtual [% IF xaps_topic %]imap_xaps[% END %] [% IF fts_support %]fts fts_solr[% END %]
#mail_plugin_dir = /usr/lib/dovecot/imap


@@ -1338,10 +1338,10 @@
# mail_log plugin provides more event logging for mail processes.
plugin {
# Events to log. Also available: flag_change append
- #mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
+ mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
# Available fields: uid, box, msgid, from, subject, size, vsize, flags
# size and vsize are available only for expunge and copy events.
- #mail_log_fields = uid box msgid size
+ mail_log_fields = uid box msgid size
}

##

Issue the following command to patch the local template with the changes to enable the mail_log plugin:

patch -p1 /var/cpanel/templates/dovecot2.3/main.local < /root/dovecot.patch

Rebuild the dovecot configuration from the local template that you just created, and then restart Dovecot:

/scripts/builddovecotconf && /scripts/restartsrv_dovecot

You tail the log at:

tail -fn0 /var/log/maillog

Resources

Dovecot Docs - mail-log plugin

cPanel Docs - The dovecot.conf file