Log entries in /var/log/maillog

Hi, How to interpret the flags that is shown in the log /var/log/maillog? I searched for a document where he explains what each one means and did not find it. I did a test with the tail -f being run in the log and realized that: trashed= Number of messages that have been sent to the trash deleted= Number of messages that have been deleted from the trash (no restore possible) Is that correct? What does the other flags mean? in= out= expunged= hdr_count= In the log block below, why does it have this value in hdr_count = 10039?

Jul 13 10:45:59 br880 dovecot: imap(user@domain.tld): Connection closed (EXPUNGE finished 31.453 secs ago) in=4771 out=44603 deleted=1 expunged=1 trashed=1 hdr_count=19
Jul 13 10:50:36 br880 dovecot: imap(user@domain.tld): Connection closed (UID SEARCH finished 31.171 secs ago) in=436818 out=20381 deleted=3 expunged=3 trashed=2 hdr_count=3
Jul 13 10:53:25 br880 dovecot: imap(user@domain.tld): Connection closed (EXPUNGE finished 0.341 secs ago) in=2200 out=13852 deleted=1 expunged=1 trashed=1 hdr_count=9
Jul 13 11:27:28 br880 dovecot: imap(user@domain.tld): Connection closed (STATUS finished 32.950 secs ago) in=2233 out=16560 deleted=1 expunged=1 trashed=1 hdr_count=8
Jul 13 14:41:35 br880 dovecot: imap(user@domain.tld): Connection closed (UID STORE finished 0.244 secs ago) in=3908 out=12171 deleted=2 expunged=2 trashed=1 hdr_count=1
Jul 13 15:11:42 br880 dovecot: imap(user@domain.tld): Connection closed (UID SEARCH finished 31.192 secs ago) in=50990 out=42658 deleted=1 expunged=1 trashed=1 hdr_count=16
Jul 13 15:47:43 br880 dovecot: imap(user@domain.tld): Connection closed (EXPUNGE finished 0.364 secs ago) in=573 out=10386 deleted=1 expunged=1 trashed=1 hdr_count=9
Jul 13 16:28:19 br880 dovecot: imap(user@domain.tld): Connection closed (UID STORE finished 0.616 secs ago) in=3782 out=13445 deleted=1 expunged=1 trashed=1 hdr_count=4
Jul 13 16:50:14 br880 dovecot: imap(user@domain.tld): Connection closed (UID STORE finished 0.201 secs ago) in=853 out=7555 deleted=1 expunged=1 trashed=1 hdr_count=1
Jul 13 17:26:33 br880 dovecot: imap(user@domain.tld): Connection closed (UID SEARCH finished 32.128 secs ago) in=1533 out=14728 deleted=4 expunged=4 trashed=4 hdr_count=6
Jul 13 17:26:33 br880 dovecot: imap(user@domain.tld): Connection closed (UID SEARCH finished 31.202 secs ago) in=3053 out=32258 deleted=3 expunged=3 trashed=3 hdr_count=21
Jul 13 18:00:49 br880 dovecot: imap(user@domain.tld): Connection closed (EXPUNGE finished 0.659 secs ago) in=462 out=3713 deleted=1 expunged=1 trashed=1 hdr_count=0
Jul 13 21:26:28 br880 dovecot: imap(user@domain.tld): Connection closed (UID FETCH finished 0.282 secs ago) in=11169 out=9482362 deleted=2 expunged=2 trashed=2 hdr_count=10039

Thanks

cPanelMichael

July 18, 2018 17:32

trashed= Number of messages that have been sent to the trash deleted= Number of messages that have been deleted from the trash (no restore possible) Is that correct? What does the other flags mean? in= out= expunged= hdr_count=

Hello @Luana Premoli, Here's a look at part of the /usr/share/doc/dovecot-2.2.36/example-config/conf.d/20-imap.conf file, which explains the purpose of each entry in the log: [QUOTE] # IMAP logout format string: # %in - total number of bytes read from client # %out - total number of bytes sent to client # %{fetch_hdr_count} - Number of mails with mail header data sent to client # %{fetch_hdr_bytes} - Number of bytes with mail header data sent to client # %{fetch_body_count} - Number of mails with mail body data sent to client # %{fetch_body_bytes} - Number of bytes with mail body data sent to client # %{deleted} - Number of mails where client added \Deleted flag # %{expunged} - Number of mails that client expunged, which does not # include automatically expunged mails # %{autoexpunged} - Number of mails that were automatically expunged after # client disconnected # %{trashed} - Number of mails that client copied/moved to the # special_use=\Trash mailbox. # %{appended} - Number of mails saved during the session #imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} \ # trashed=%{trashed} hdr_count=%{fetch_hdr_count} \ # hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} \ # body_bytes=%{fetch_body_bytes}
Thank you.

Luana Premoli

July 18, 2018 19:27

Hi, Thanks for your help. =)

Log entries in /var/log/maillog

Comments

Didn't find what you were looking for?