How to enable Dovecot RawLogs on a cPanel server temporarily

Introduction

There may be times where emails are missing and there is difficulty determining how they are being removed. If they are being done via IMAP commands via a mail client then there will be no way to determine that without enabling RawLogs. Be aware this logging is very verbose and should be left in place temporarily.

Procedure

Modify /etc/dovecot/dovecot.conf and search for "service managesieve-login {"

Just above this add the following lines

service postlogin {
executable = script-login -d rawlog
unix_listener postlogin {
}
}

Then search for "service imap {" and just under that line add

executable = imap postlogin

and then save the file.

The first mentioned section will look like this.

service postlogin {
executable = script-login -d rawlog
unix_listener postlogin {
}
}
service managesieve-login {

and the second like this

service imap {
executable = imap postlogin
# Maximum number of running mail processes. When this limit is reached,
# new users aren't allowed to log in.

After making this change the following needs to be run to restart dovecot.

/scripts/restartsrv_dovecot --hard

The following can be done to backup this for future reference and reset the changes.

cp -ax /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf$(date +%s)
/scripts/builddovecotconf
/scripts/restartsrv_dovecot --hard

NOTE: The rawlog binary method provided above is a legacy method and the newer method is more simple to set up. Please refer to the following documentation:

https://doc.dovecot.org/settings/core/#setting-rawlog-dir

https://doc.dovecot.org/admin_manual/debugging/debugging_rawlog/

How to enable Dovecot's rawlog to track mail client actions