Introduction
There may be times where emails are missing and there is difficulty determining how they are being removed. If they are being done via IMAP commands via a mail client then there will be no way to determine that without enabling RawLogs. Be aware this logging is very verbose and should be left in place temporarily.
Procedure
Modify /etc/dovecot/dovecot.conf and search for "service managesieve-login {"
Just above this add the following lines
service postlogin {
executable = script-login -d rawlog
unix_listener postlogin {
}
}
Then search for "service imap {" and just under that line add
executable = imap postlogin
and then save the file.
The first mentioned section will look like this.
service postlogin {
executable = script-login -d rawlog
unix_listener postlogin {
}
}
service managesieve-login {
and the second like this
service imap {
executable = imap postlogin
# Maximum number of running mail processes. When this limit is reached,
# new users aren't allowed to log in.
After making this change the following needs to be run to restart dovecot.
/scripts/restartsrv_dovecot --hard
The following can be done to backup this for future reference and reset the changes.
cp -ax /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf$(date +%s)
/scripts/builddovecotconf
/scripts/restartsrv_dovecot --hard
NOTE: The rawlog binary method provided above is a legacy method and the newer method is more simple to set up. Please refer to the following documentation:
https://doc.dovecot.org/settings/core/#setting-rawlog-dir
https://doc.dovecot.org/admin_manual/debugging/debugging_rawlog/