Ralf Hildebrandt
2012-Sep-24 11:27 UTC
[Dovecot] Logging question regarding delete actions
A user is logged in via imap from multiple devices. The log has this: Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15347, msgid=<1341851741.4ffb085d2e2b7 at swift.generated>, size=15675 Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15739, msgid=<b23b2e42f6ae9ba1602690be42b7b5c7.squirrel at webmail.charite.de>, size=18134 Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15740, msgid=<3509D8B3F9054C4BB26C85F3E4B96563036822877538 at EXCHANGE21.charite.de>, size=22226 Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15741, msgid=<C2E306F4-8622-4D0F-98BD-C67F31F2FF08 at charite.de>, size=5160 How can I find out WHICH CLIENT caused the deletion? Same issue: Sep 21 09:36:05 postamt dovecot: imap-login: Login: user=<awxxxxer>, method=PLAIN, rip=109.45.0.37, lip=141.42.206.36, mpid=30773, TLS, session=<e8TfSjHKgwBtLQAl> Sep 21 10:06:17 postamt dovecot: imap(awxxxxer): Disconnected for inactivity in=2255 out=4398 How can I be sure that the log entry from 10:06:17 "belongs" to the log entry from "09:36:05"? Also, what is the meaning of the "session=<e8TfSjHKgwBtLQAl>"? -- Ralf Hildebrandt Gesch?ftsbereich IT | Abteilung Netzwerk Charit? - Universit?tsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt at charite.de | http://www.charite.de
On 24.9.2012, at 14.27, Ralf Hildebrandt wrote:> A user is logged in via imap from multiple devices. > The log has this: > > Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15347, msgid=<1341851741.4ffb085d2e2b7 at swift.generated>, size=15675 > Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15739, msgid=<b23b2e42f6ae9ba1602690be42b7b5c7.squirrel at webmail.charite.de>, size=18134 > Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15740, msgid=<3509D8B3F9054C4BB26C85F3E4B96563036822877538 at EXCHANGE21.charite.de>, size=22226 > Sep 21 11:46:32 postamt dovecot: imap(awxxxxer): delete: box=INBOX, uid=15741, msgid=<C2E306F4-8622-4D0F-98BD-C67F31F2FF08 at charite.de>, size=5160 > > How can I find out WHICH CLIENT caused the deletion?Change mail_log_prefix to include %{session} (and maybe %r for IP).> Same issue: > > Sep 21 09:36:05 postamt dovecot: imap-login: Login: user=<awxxxxer>, method=PLAIN, rip=109.45.0.37, lip=141.42.206.36, mpid=30773, TLS, session=<e8TfSjHKgwBtLQAl> > Sep 21 10:06:17 postamt dovecot: imap(awxxxxer): Disconnected for inactivity in=2255 out=4398 > > How can I be sure that the log entry from 10:06:17 "belongs" to the > log entry from "09:36:05"? Also, what is the meaning of the > "session=<e8TfSjHKgwBtLQAl>"?This is also solved with mail_log_prefix change. The session's idea is exactly to match the same session's log messages together. It's a string guaranteed to be unique for the next .. was it 7 years or so.