Events¶

List of all events emitted by Dovecot for statistics, exporting and filtering.

Categories¶

Root Categories

Category	Description
`auth`	Authentication (server mainly)
`auth-client`	Authentication client library
`dict`	Dictionary library and drivers
`dict-server`	Dictionary server/proxy (dict process)
`dns`	DNS client library
`dns-worker`	dns-client process
`fs`	FS library
`fs-dictmap`	fs-dictmap
`fts`	Full text search plugin
`fts-dovecot`	Dovecot Pro FTS Engine
`http-client`	HTTP client library New in version 2.3.16.
`http-server`	HTTP server library
`imap`	imap process
`imap-urlauth`	imap-urlauth process
`imap-hibernate`	imap-hibernate process
`lda`	dovecot-lda process
`local-delivery`	LDA/LMTP local delivery
`lmtp`	LMTP process
`lua`	Lua script
`mail-cache`	`dovecot.index.cache` file handling
`mail-index`	`dovecot.index*` file handling
`managesieve`	Managesieve
`metacache`	obox metacache
`pop3`	POP3 process
`push-notification`	push-notification plugin Changed in version 2.3.11: This was previously named `push_notification`.
`quota-status`	quota-status process
`service:<name>`	Named service, e.g. service:imap or service:auth
`smtp-client`	SMTP/LMTP client
`smtp-server`	SMTP/LMTP server
`smtp-submit`	SMTP submission client
`ssl`	SSL/TLS connections
`ssl-client`	Incoming SSL/TLS connections
`ssl-server`	Outgoing SSL/TLS connections
`submission`	Submission process

Storage Categories

Category	Description
`storage`	Mail storage parent category
imapc	imapc storage
`mailbox`	Mailbox (folder)
maildir	Maildir storage
mbox	mbox storage
mdbox	mdbox storage
obox	obox storage
sdbox	sdbox storage
pop3c	pop3c storage

Sieve Categories

New in version 2.3.11: makes the sieve category parent for the other sieve-* categories.

Category	Description
`sieve`	Sieve parent category
`sieve-action`	Individual Sieve actions executed.
`sieve-execute`	Sieve script(s) being executed for a particular message. This envelops all of Sieve execution; both runtime and action execution.
`sieve-runtime`	Evaluation of individual Sieve scripts
`sieve-storage`	Sieve storage

SQL Categories

Category	Description
`sql`	SQL parent category
`cassandra`	Cassandra CQL events
`mysql`	MySQL events
`pgsql`	PostgreSQL events
`sqlite`	SQLite events
`sqlpool`	SQL is used internally via “SQL connection pools”

Events¶

Authentication Client¶

These events are generated by authentication clients (lib-auth).

auth_client_cache_flush_started¶

New in version 2.3.7.

Removed in version 2.4.0 (CE).

Removed in version 3.0.0 (Pro).

Deprecated; do not use.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

auth_client_cache_flush_finished¶

New in version 2.3.7.

Removed in version 2.4.0 (CE).

Removed in version 3.0.0 (Pro).

Deprecated; do not use.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error string if error occurred.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

auth_client_passdb_lookup_started¶

New in version 2.3.7.

Authentication client starts a passdb lookup.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Full username to lookup.

auth_client_passdb_lookup_finished¶

New in version 2.3.7.

Authentication client finishes a passdb lookup.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Full username to lookup.

auth_client_request_started¶

New in version 2.3.7.

Authentication client starts authentication request.

View Event Fields

Field	Description
`auth_user`	Auth username, if present.
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`original_user`	Original username, if present.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username, if present

auth_client_request_challenged¶

New in version 2.3.7.

Authentication client receives a request from server to continue SASL authentication.

View Event Fields

Field	Description
`auth_user`	Auth username, if present.
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`original_user`	Original username, if present.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username, if present

auth_client_request_continued¶

New in version 2.3.7.

Authentication client continues SASL authentication by sending a response to server request.

View Event Fields

Field	Description
`auth_user`	Auth username, if present.
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`original_user`	Original username, if present.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username, if present

auth_client_request_finished¶

New in version 2.3.7.

Authentication client receives response from server that authentication is finished, either success or failure.

View Event Fields

Field	Description
`auth_user`	Auth username, if present.
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`original_user`	Original username, if present.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username, if present

auth_client_userdb_list_started¶

New in version 2.3.7.

Authentication client starts userdb iteration.

View Event Fields

Field	Description
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`.
`duration`	Duration of the event (in microseconds)
`local_ip`	Local IP client connected to.
`local_name`	TLS SNI.
`local_port`	Local port client connected to.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`real_local_ip`	Real local IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP of client.
`remote_port`	Remote port of client.
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, …
`session`	Session identifier.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`user_mask`	User mask to list.

auth_client_userdb_list_finished¶

New in version 2.3.7.

Authentication client finishes userdb iteration.

View Event Fields

Field	Description
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`.
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`local_ip`	Local IP client connected to.
`local_name`	TLS SNI.
`local_port`	Local port client connected to.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`real_local_ip`	Real local IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP of client.
`remote_port`	Remote port of client.
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, …
`session`	Session identifier.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`user_mask`	User mask to list.

auth_client_userdb_lookup_started¶

New in version 2.3.7.

Authentication client starts a userdb lookup.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Full username to lookup.

auth_client_userdb_lookup_finished¶

New in version 2.3.7.

Authentication client finishes a userdb lookup.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error string, if error occurred.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Full username to lookup.

auth_request_finished¶

New in version 2.3.7.

Authentication request finished.

Most useful for tracking status of authentication/login attempts.

View Event Fields

Field	Description
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`. New in version 2.3.12.
`duration`	Duration of the event (in microseconds)
`error`	Set when error happens.
`local_ip`	Local IP address where client connected to. New in version 2.3.12.
`local_name`	TLS SNI hostname, if given. New in version 2.3.12.
`local_port`	Local port where the client connected to. New in version 2.3.12.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN). New in version 2.3.12.
`original_user`	Original username exactly as provided by the client.
`policy_penalty`	Time of penalty added by policy server.
`policy_result`	`ok`, `delayed`, or `refused`.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy’s IP where proxy connected to. New in version 2.3.12.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to. New in version 2.3.12.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy’s IP address. New in version 2.3.12.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection’s port. New in version 2.3.12.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP address of the client connection. New in version 2.3.12.
`remote_port`	Remote port of the client connection. New in version 2.3.12.
`service`	Service doing the lookup (e.g. `imap`, `pop3`, …). New in version 2.3.12.
`session`	Session ID. New in version 2.3.12.
`success`	`yes`, when authentication succeeded.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`transport`	Client connection’s transport security. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS` New in version 2.3.12.
`user`	Full username. This can change during authentication, for example due to passdb lookups.

auth_passdb_request_started¶

New in version 2.3.7.

Processing has begun for a passdb block.

Most useful for debugging authentication flow.

View Event Fields

Field	Description
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`. New in version 2.3.12.
`duration`	Duration of the event (in microseconds)
`local_ip`	Local IP address where client connected to. New in version 2.3.12.
`local_name`	TLS SNI hostname, if given. New in version 2.3.12.
`local_port`	Local port where the client connected to. New in version 2.3.12.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN). New in version 2.3.12.
`original_user`	Original username exactly as provided by the client.
`passdb`	Driver name.
`passdb_id`	Internal ID number of the passdb. May be useful to identify the passdb if it has no name. New in version 2.3.9.
`passdb_name`	`passdb { name }`, if it is configured. Otherwise, same as `passdb { driver }`.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy’s IP where proxy connected to. New in version 2.3.12.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to. New in version 2.3.12.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy’s IP address. New in version 2.3.12.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection’s port. New in version 2.3.12.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP address of the client connection. New in version 2.3.12.
`remote_port`	Remote port of the client connection. New in version 2.3.12.
`service`	Service doing the lookup (e.g. `imap`, `pop3`, …). New in version 2.3.12.
`session`	Session ID. New in version 2.3.12.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`transport`	Client connection’s transport security. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS` New in version 2.3.12.
`user`	Full username. This can change during authentication, for example due to passdb lookups.

auth_passdb_request_finished¶

New in version 2.3.7.

Processing has ended for a passdb block.

Most useful for debugging authentication flow.

View Event Fields

Field	Description
`cache`	`miss`: Was not cached `hit`: Found from cache New in version 2.3.19.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`. New in version 2.3.12.
`duration`	Duration of the event (in microseconds)
`local_ip`	Local IP address where client connected to. New in version 2.3.12.
`local_name`	TLS SNI hostname, if given. New in version 2.3.12.
`local_port`	Local port where the client connected to. New in version 2.3.12.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN). New in version 2.3.12.
`original_user`	Original username exactly as provided by the client.
`passdb`	Driver name.
`passdb_id`	Internal ID number of the passdb. May be useful to identify the passdb if it has no name. New in version 2.3.9.
`passdb_name`	`passdb { name }`, if it is configured. Otherwise, same as `passdb { driver }`.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy’s IP where proxy connected to. New in version 2.3.12.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to. New in version 2.3.12.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy’s IP address. New in version 2.3.12.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection’s port. New in version 2.3.12.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP address of the client connection. New in version 2.3.12.
`remote_port`	Remote port of the client connection. New in version 2.3.12.
`result`	`ok` `password_mismatch` `user_unknown` `pass_expired` `user_disabled` `scheme_not_available` `internal_failure` `next`
`service`	Service doing the lookup (e.g. `imap`, `pop3`, …). New in version 2.3.12.
`session`	Session ID. New in version 2.3.12.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`transport`	Client connection’s transport security. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS` New in version 2.3.12.
`user`	Full username. This can change during authentication, for example due to passdb lookups.

auth_userdb_request_started¶

New in version 2.3.7.

Processing has begun for a userdb block.

Most useful for debugging authentication flow.

View Event Fields

Field	Description
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`. New in version 2.3.12.
`duration`	Duration of the event (in microseconds)
`local_ip`	Local IP address where client connected to. New in version 2.3.12.
`local_name`	TLS SNI hostname, if given. New in version 2.3.12.
`local_port`	Local port where the client connected to. New in version 2.3.12.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN). New in version 2.3.12.
`original_user`	Original username exactly as provided by the client.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy’s IP where proxy connected to. New in version 2.3.12.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to. New in version 2.3.12.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy’s IP address. New in version 2.3.12.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection’s port. New in version 2.3.12.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP address of the client connection. New in version 2.3.12.
`remote_port`	Remote port of the client connection. New in version 2.3.12.
`service`	Service doing the lookup (e.g. `imap`, `pop3`, …). New in version 2.3.12.
`session`	Session ID. New in version 2.3.12.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`transport`	Client connection’s transport security. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS` New in version 2.3.12.
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`userdb`	Driver name.
`userdb_id`	Internal ID number of the userdb. May be useful to identify the userdb if it has no name. New in version 2.3.9.
`userdb_name`	`userdb { name }`, if it is configured. Otherwise, same as `userdb { driver }`.

auth_userdb_request_finished¶

New in version 2.3.7.

Processing has ended for a userdb block.

Most useful for debugging authentication flow.

View Event Fields

Field	Description
`cache`	`miss`: Was not cached `hit`: Found from cache New in version 2.3.19.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`. New in version 2.3.12.
`duration`	Duration of the event (in microseconds)
`local_ip`	Local IP address where client connected to. New in version 2.3.12.
`local_name`	TLS SNI hostname, if given. New in version 2.3.12.
`local_port`	Local port where the client connected to. New in version 2.3.12.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN). New in version 2.3.12.
`original_user`	Original username exactly as provided by the client.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy’s IP where proxy connected to. New in version 2.3.12.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to. New in version 2.3.12.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy’s IP address. New in version 2.3.12.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection’s port. New in version 2.3.12.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP address of the client connection. New in version 2.3.12.
`remote_port`	Remote port of the client connection. New in version 2.3.12.
`result`	`ok` `user_unknown` `internal_failure`
`service`	Service doing the lookup (e.g. `imap`, `pop3`, …). New in version 2.3.12.
`session`	Session ID. New in version 2.3.12.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`transport`	Client connection’s transport security. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS` New in version 2.3.12.
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`userdb`	Driver name.
`userdb_id`	Internal ID number of the userdb. May be useful to identify the userdb if it has no name. New in version 2.3.9.
`userdb_name`	`userdb { name }`, if it is configured. Otherwise, same as `userdb { driver }`.

auth_policy_request_finished¶

New in version 2.3.7.

Processing has ended for an auth policy request.

Most useful for debugging authentication flow.

View Event Fields

Field	Description
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain=yes`. New in version 2.3.12.
`duration`	Duration of the event (in microseconds)
`local_ip`	Local IP address where client connected to. New in version 2.3.12.
`local_name`	TLS SNI hostname, if given. New in version 2.3.12.
`local_port`	Local port where the client connected to. New in version 2.3.12.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN). New in version 2.3.12.
`mode`	Either `allow` or `report`.
`original_user`	Original username exactly as provided by the client.
`policy_result`	Value returned from policy server (number).
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy’s IP where proxy connected to. New in version 2.3.12.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to. New in version 2.3.12.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy’s IP address. New in version 2.3.12.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection’s port. New in version 2.3.12.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP address of the client connection. New in version 2.3.12.
`remote_port`	Remote port of the client connection. New in version 2.3.12.
`service`	Service doing the lookup (e.g. `imap`, `pop3`, …). New in version 2.3.12.
`session`	Session ID. New in version 2.3.12.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`transport`	Client connection’s transport security. Values: `insecure` `secured` Changed in version 2.4.0 (CE): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. Changed in version 3.0.0 (Pro): Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS` New in version 2.3.12.
`user`	Full username. This can change during authentication, for example due to passdb lookups.

Authentication Master Client¶

These events are generated by master authentication clients (lib-master). This happens when e.g. IMAP finishes the login by doing a userdb lookup.

auth_master_client_login_started¶

Authentication master login request started.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`id`	Login request ID.
`local_ip`	Client connection’s local (server) IP.
`local_port`	Client connection’s local (server) port.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Client connection’s remote (client) IP.
`remote_port`	Client connection’s remote (client) port.

auth_master_client_login_finished¶

Authentication master login request finished.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the request failed.
`id`	Login request ID.
`local_ip`	Client connection’s local (server) IP.
`local_port`	Client connection’s local (server) port.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Client connection’s remote (client) IP.
`remote_port`	Client connection’s remote (client) port.
`user`	Username of the user.

Connection¶

These events apply only for connections using the connection API.

Note

Not all connections currently use this API, so these events work for some types of connections, but not for others.

client_connection_connected¶

Server accepted an incoming client connection.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`local_ip`	Local server IP address where TCP client connected to.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote TCP client’s IP address.
`remote_pid`	Remote UNIX socket client’s process ID.
`remote_port`	Remote TCP client’s source port.
`remote_uid`	Remote UNIX socket client’s system user ID.

client_connection_disconnected¶

Client connection is terminated.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`local_ip`	Local server IP address where TCP client connected to.
`net_in_bytes`	Amount of data read, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`net_out_bytes`	Amount of data written, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`reason`	Disconnection reason.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote TCP client’s IP address.
`remote_pid`	Remote UNIX socket client’s process ID.
`remote_port`	Remote TCP client’s source port.
`remote_uid`	Remote UNIX socket client’s system user ID.

server_connection_connected¶

Outgoing server connection was either successfully established or failed.

Note

Currently it is not possible to know which one happened.

View Event Fields

Field	Description
`dest_host`	TCP connection’s destination hostname, if known.
`dest_ip`	TCP connection’s destination IP address.
`dest_port`	TCP connection’s destination port.
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_pid`	Remote UNIX socket server’s process ID.
`remote_uid`	Remote UNIX socket server’s system user ID.
`socket_path`	UNIX socket connection’s path.
`source_ip`	Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested.

server_connection_disconnected¶

Server connection is terminated.

View Event Fields

Field	Description
`dest_host`	TCP connection’s destination hostname, if known.
`dest_ip`	TCP connection’s destination IP address.
`dest_port`	TCP connection’s destination port.
`duration`	Duration of the event (in microseconds)
`reason`	Disconnection reason.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_pid`	Remote UNIX socket server’s process ID.
`remote_uid`	Remote UNIX socket server’s system user ID.
`socket_path`	UNIX socket connection’s path.
`source_ip`	Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested.

FS¶

fs¶

May be inherited from various different parents (e.g. “Mail User” event) or even from no parent.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

fs_file¶

Inherits from fs or any other specified event (e.g. mail).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

fs_iter¶

Inherits from fs or any other specified event (e.g. mailbox).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`file_type`	(This field only exists for files accessed via obox.) `mail`: Email file `index`: Index bundle `box`: Mailbox directory (for creating/deleting it, if used by the storage driver) `fts`: FTS file
`reason`	Reason for accessing the file. (This field only exists for files accessed via obox.)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

Storage¶

Mail User¶

mail_user_session_finished¶

New in version 2.3.19.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`invol_cs`	Involuntary context switches
`major_faults`	Page faults (hard page faults)
`minor_faults`	Page reclaims (soft page faults)
`net_in_bytes`	Bytes received during this session (for applicable processes.) New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`net_out_bytes`	Bytes sent during this session (for applicable processes.) New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`rchar`	I/O counter: chars (bytes) read from storage (Skipped in non-Linux environments.)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rss`	Resident set size in bytes. (Skipped in non-Linux environments.)
`stime`	System CPU time used in microseconds
`syscr`	Number of read syscalls (Skipped in non-Linux environments.)
`syscw`	Number of write syscalls (Skipped in non-Linux environments.)
`user`	Username of the user.
`utime`	User CPU time used in microseconds
`vol_cs`	Voluntary context switches
`vsz`	Virtual memory size in bytes. (Skipped in non-Linux environments.)
`wchar`	I/O counter: chars (bytes) written to storage (Skipped in non-Linux environments.)

Mailbox¶

mail_expunged¶

New in version 2.3.15.

A mail was expunged from the mailbox. Note that this event inherits from mailbox, not mail.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`uid`	UID of the expunged mail.

Mail¶

mail_metadata_accessed¶

New in version 2.4.0 (CE).

New in version 3.0.0 (Pro).

A mail was opened for reading its metadata. Note that this event is not sent when mails’ body is accessed.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`seq`	Mail sequence number.
`uid`	Mail IMAP UID number.

mail_opened¶

New in version 2.3.15.

A mail was opened e.g. for reading its body. Note that this event is not sent when mails’ metadata is accessed, even if it causes opening the mail file.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason`	Reason why the mail was opened. (optional)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`seq`	Mail sequence number.
`uid`	Mail IMAP UID number.

mail_expunge_requested¶

New in version 2.3.15.

A mail is set to be expunged. (Note that expunges can be rolled back later on, this event is emitted when an expunge is requested).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`seq`	Mail sequence number.
`uid`	Mail IMAP UID number.

Mail Index¶

Index¶

Index file handling for dovecot.index*, dovecot.map.index*, dovecot.list.index* and similar indexes.

mail_index_recreated¶

New in version 2.3.12.

A mail index file was recreated.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`filepath`	Path to the index file being recreated.
`reason`	Human-readable reason why the mail index was recreated.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

indexer_worker_indexing_finished¶

New in version 2.3.15.

Indexer worker process completed an indexing transaction.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`first_uid`	UID of the first indexed message.
`last_uid`	UID of the last indexed message.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`message_count`	Number of messages indexed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user_cpu_usecs`	Total user CPU spent on the indexing transaction in microseconds.

Cache¶

mail_cache_decision_changed¶

New in version 2.3.11.

A field’s caching decision changed. The decisions are:

Decision	Description
`no`	The field is not cached.
`temp`	The field is cached for 1 week and dropped on the next purge.
`yes`	The field is cached permanently. If the field isn’t accessed for 30 days it’s dropped.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`field`	Cache field name (e.g. `imap.body` or `hdr.from`).
`last_used`	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.
`new_decision`	New cache decision: `no`, `temp`, or `yes`.
`old_decision`	Old cache decision: `no`, `temp`, or `yes`.
`reason`	Reason why the caching decision changed: `add`: no -> temp decision change, because a new field was added to cache. `old_mail`: temp -> yes decision change, because a mail older than 1 week was accessed. `unordered_access`: temp -> yes decision change, because mails weren’t accessed in ascending order. Other values indicate a reason for cache purging, which changes the caching decision yes -> temp.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`uid`	IMAP UID number that caused the decision change. This is set only for some reasons, not all.

mail_cache_decision_rejected¶

The decision to promote a field (from no to temp) was rejected.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`field`	Cache field name (e.g. `hdr.from`).
`reason`	Reason why the caching decision changed: `too_many_headers` - This can happen when the count of headers in the cache exceeds the maximum configured with `mail_cache_max_headers_count`.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

mail_cache_purge_started¶

New in version 2.3.11.

Cache file purging is started.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`file_seq`	Sequence of the new cache file that is created.
`prev_deleted_records`	Number of records (mails) marked as deleted in the cache file that is to be purged.
`prev_file_seq`	Sequence of the cache file that is to be purged.
`prev_file_size`	Size of the cache file that is to be purged.
`reason`	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

mail_cache_purge_drop_field¶

New in version 2.3.11.

Existing field is dropped from the cache file because it hadn’t been accessed for 30 days.

View Event Fields

Field	Description
`decision`	Old caching decision: `temp`, or `yes`.
`duration`	Duration of the event (in microseconds)
`field`	Cache field name (e.g. `imap.body` or `hdr.from`).
`file_seq`	Sequence of the new cache file that is created.
`last_used`	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.
`prev_deleted_records`	Number of records (mails) marked as deleted in the cache file that is to be purged.
`prev_file_seq`	Sequence of the cache file that is to be purged.
`prev_file_size`	Size of the cache file that is to be purged.
`reason`	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

mail_cache_purge_finished¶

New in version 2.3.11.

TODO

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`file_seq`	Sequence of the new cache file that is created.
`file_size`	Size of the new cache file.
`max_uid`	IMAP UID of the last mail in the cache file.
`prev_deleted_records`	Number of records (mails) marked as deleted in the cache file that is to be purged.
`prev_file_seq`	Sequence of the cache file that is to be purged.
`prev_file_size`	Size of the cache file that is to be purged.
`reason`	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

mail_cache_corrupted¶

New in version 2.3.11.

Cache file was found to be corrupted and the whole file is deleted.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason`	Reason string why cache was found to be corrupted.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

mail_cache_record_corrupted¶

New in version 2.3.11.

Cache record for a specific mail was found to be corrupted and the record is deleted.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason`	Reason string why cache was found to be corrupted.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`uid`	IMAP UID of the mail whose cache record is corrupted.

mail_cache_lookup_finished¶

New in version 2.3.15.

Removed in version 2.3.18: Removed for performance reasons

A mail field was looked up from cache.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`field`	Cache field name (e.g. `imap.body` or `hdr.from`).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

HTTP Client¶

These events are emitted by Dovecot’s internal HTTP library when acting as a client to an external service.

http_request_finished¶

HTTP request is complete.

This event is useful to track and monitor external services.

View Event Fields

Field	Description
`attempts`	Amount of individual HTTP request attempts (number of retries after failures + 1).
`dest_host`	Destination host.
`dest_ip`	Destination IP address.
`dest_port`	Destination port.
`duration`	Duration of the event (in microseconds)
`method`	HTTP verb used uppercased, e.g. `GET`.
`net_in_bytes`	Amount of data read, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`net_out_bytes`	Amount of data written, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`redirects`	Number of redirects done while processing request.
`status_code`	HTTP result status code (integer).
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

http_request_redirected¶

Intermediate event emitted when an HTTP request is being redirected.

The http_request_finished event is still sent at the end of the request.

View Event Fields

Field	Description
`attempts`	Amount of individual HTTP request attempts (number of retries after failures + 1).
`dest_host`	Destination host.
`dest_ip`	Destination IP address.
`dest_port`	Destination port.
`duration`	Duration of the event (in microseconds)
`method`	HTTP verb used uppercased, e.g. `GET`.
`net_in_bytes`	Amount of data read, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`net_out_bytes`	Amount of data written, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`redirects`	Number of redirects done while processing request.
`status_code`	HTTP result status code (integer).
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

http_request_retried¶

Intermediate event emitted when an HTTP request is being retried.

The http_request_finished event is still sent at the end of the request.

View Event Fields

Field	Description
`attempts`	Amount of individual HTTP request attempts (number of retries after failures + 1).
`dest_host`	Destination host.
`dest_ip`	Destination IP address.
`dest_port`	Destination port.
`duration`	Duration of the event (in microseconds)
`method`	HTTP verb used uppercased, e.g. `GET`.
`net_in_bytes`	Amount of data read, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`net_out_bytes`	Amount of data written, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`redirects`	Number of redirects done while processing request.
`status_code`	HTTP result status code (integer).
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

HTTP Server¶

These events are emitted by Dovecot’s internal HTTP library when serving requests (e.g. doveadm HTTP API).

http_server_request_started¶

New in version .3.18.

A new HTTP request has been received and the request headers (but not body payload) are parsed.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`method`	HTTP verb used uppercased, e.g. `GET`.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`request_id`	Assigned ID of the received request.
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

http_server_request_finished¶

New in version 2.3.18.

HTTP request is fully completed, i.e. the incoming request body is read and the full response to the request has been sent to the client.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`method`	HTTP verb used uppercased, e.g. `GET`.
`net_in_bytes`	Amount of request data read, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`net_out_bytes`	Amount of response data written, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`request_id`	Assigned ID of the received request.
`status_code`	HTTP result status code (integer).
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

pop3_command_finished¶

New in version 2.4.0 (CE).

New in version 3.0.0 (Pro).

POP3 command is completed.

This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.

Note

This event is currently not sent for pre-login POP3 commands.

View Event Fields

Field	Description
`cmd_args`	POP3 command’s full parameters (e.g. `1 1`). New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`cmd_name`	POP3 command name uppercased (e.g. `UIDL`). New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`duration`	Duration of the event (in microseconds)
`net_in_bytes`	Amount of data read for this command, in bytes.
`net_out_bytes`	Amount of data written for this command, in bytes.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`reply`	POP3 reply: Values: * `OK` * `FAIL`

IMAP¶

IMAP Client¶

imap_client_hibernated¶

New in version 2.3.13.

IMAP client is hibernated or the hibernation attempt failed.

Note

For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Reason why hibernation attempt failed.
`local_ip`	IMAP connection’s local (server) IP. New in version 2.3.9.
`local_port`	IMAP connection’s local (server) port. New in version 2.3.9.
`mailbox`	Mailbox name where hibernation was started in.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	IMAP connection’s remote (client) IP. New in version 2.3.9.
`remote_port`	IMAP connection’s remote (client) port. New in version 2.3.9.
`session`	Session ID of the IMAP connection.
`user`	Username of the user.

imap_client_unhibernated¶

New in version 2.3.13.

IMAP client is unhibernated or the unhibernation attempt failed.

Note

For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

See also imap process’s imap_client_unhibernated event.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`hibernation_usecs`	Number of microseconds how long the client was hibernated.
`local_ip`	IMAP connection’s local (server) IP. New in version 2.3.9.
`local_port`	IMAP connection’s local (server) port. New in version 2.3.9.
`mailbox`	Mailbox name where hibernation was started in.
`reason`	Reason why client was unhibernated: `idle_done`: IDLE command was stopped with DONE. `idle_bad_reply`: IDLE command was stopped with some other command than DONE. `mailbox_changes`: Mailbox change notifications need to be sent to the client.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	IMAP connection’s remote (client) IP. New in version 2.3.9.
`remote_port`	IMAP connection’s remote (client) port. New in version 2.3.9.
`session`	Session ID of the IMAP connection.
`user`	Username of the user.

imap_client_unhibernate_retried¶

New in version 2.3.13.

An IMAP client is attempted to be unhibernated, but imap processes are busy and the unhibernation attempt is retried.

This event is sent each time when retrying is done.

The imap_client_unhibernated event is still sent when unhibernation either succeeds or fails permanently.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Reason why unhibernation failed.
`local_ip`	IMAP connection’s local (server) IP. New in version 2.3.9.
`local_port`	IMAP connection’s local (server) port. New in version 2.3.9.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	IMAP connection’s remote (client) IP. New in version 2.3.9.
`remote_port`	IMAP connection’s remote (client) port. New in version 2.3.9.
`session`	Session ID of the IMAP connection.
`user`	Username of the user.

IMAP Command¶

imap_command_finished¶

IMAP command is completed.

This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.

Note

This event is currently not sent for pre-login IMAP commands.

View Event Fields

Field	Description
`cmd_args`	IMAP command’s full parameters (e.g. `1:* FLAGS`). New in version 2.3.9.
`cmd_human_args`	IMAP command’s full parameters, as human-readable output. Often it’s the same as `cmd_args`, but it is guaranteed to contain only valid UTF-8 characters and no control characters. Multi-line parameters are written only as `<N byte multi-line literal>`. New in version 2.3.9.
`cmd_input_name`	IMAP command name exactly as sent (e.g. `fetcH`) regardless of whether or not it is valid. New in version 2.3.11.
`cmd_name`	IMAP command name uppercased (e.g. `FETCH`). New in version 2.3.9.
`cmd_tag`	IMAP command tag. New in version 2.3.9.
`duration`	Duration of the event (in microseconds)
`last_run_time`	Timestamp when the command was running last time. (Command may be followed by internal “mailbox sync” that can take some time to complete)
`lock_wait_usecs`	How many usecs this command has spent waiting for locks.
`net_in_bytes`	Amount of data read for this command, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`net_out_bytes`	Amount of data written for this command, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`running_usecs`	How many usecs this command has spent running.
`tagged_reply`	Full tagged reply (e.g. `OK SELECT finished.`).
`tagged_reply_state`	Values: * `OK` * `NO` * `BAD`

imap_id_received¶

New in version 2.4.0 (CE).

New in version 3.0.0 (Pro).

This event is emitted when the IMAP ID command was received, both for pre- as well as post-login. The parameters slightly differ for an unauthenticated client, e.g. there is no user id.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`id_invalid<num>`	Each key that contains invalid characters are enumerated starting with 1. Valid characters are latin alphabetic characters (= `a` .. `z`), numerals (= `0` .. `9`), the dash (= `-`) and the underscore (= `_`), every other character is considered invalid. The value of this field is the original parameter key including invalid characters, followed by a space character, and finally the original value concatenated into a single string.
`id_param_<param>`	Received parameters. The event name is the lowercase parameter key prefixed with `id_param_`, the value is the parameter value.
`local_ip`	IMAP connection’s local (server) IP. New in version 2.3.9.
`local_port`	IMAP connection’s local (server) port. New in version 2.3.9.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	IMAP connection’s remote (client) IP. New in version 2.3.9.
`remote_port`	IMAP connection’s remote (client) port. New in version 2.3.9.
`session`	Session ID of the IMAP connection.
`user`	Username of the user.

Mail Delivery¶

Events emitted on mail delivery.

mail_delivery_started¶

New in version 2.3.8.

Message delivery has started.

This event is useful for debugging mail delivery flow.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`message_from`	Email address in the From header (e.g. `user@example.com`).
`message_id`	Message-ID header value (truncated to 200 bytes).
`message_size`	Size of the message, in bytes.
`message_subject`	Subject header value, in UTF-8 (truncated to 80 bytes).
`message_vsize`	Size of the message with CRLF linefeeds, in bytes.
`rcpt_to`	The envelope recipient for the message.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

mail_delivery_finished¶

New in version 2.3.8.

Message delivery is completed.

This event is useful for logging and tracking mail deliveries.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the delivery failed.
`message_from`	Email address in the From header (e.g. `user@example.com`).
`message_id`	Message-ID header value (truncated to 200 bytes).
`message_size`	Size of the message, in bytes.
`message_subject`	Subject header value, in UTF-8 (truncated to 80 bytes).
`message_vsize`	Size of the message with CRLF linefeeds, in bytes.
`rcpt_to`	The envelope recipient for the message.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

DNS¶

Events emitted from Dovecot’s internal DNS client.

dns_worker_request_started¶

DNS request started being processed by DNS worker process.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

dns_request_started¶

DNS request sent by DNS client library to DNS worker process.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

dns_worker_request_finished¶

DNS request finished being processed by DNS worker process.

View Event Fields

Field	Description
`cached`	Set to `yes` or `no` depending if it was a cached reply or not. New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`duration`	Duration of the event (in microseconds)
`error`	Human readable error.
`error_code`	Error code usable with net_gethosterror().
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

dns_request_finished¶

DNS request sent by DNS client library to DNS worker process has been finished.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Human readable error.
`error_code`	Error code usable with net_gethosterror().
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

SQL¶

Events emitted by Dovecot’s internal SQL library.

Note

This includes queries sent to Cassandra.

sql_query_finished¶

Response was received to SQL query.

View Event Fields

Field	Description
`consistency`	Requested consistency for the query (Cassandra only) New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`duration`	Duration of the event (in microseconds)
`error`	Human readable error.
`error_code`	Error code (if available).
`error_consistency`	Consistency attempted to be used by Cassandra for the failed query (Cassandra only) New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`query_first_word`	First word of the query (e.g. `SELECT`).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

sql_transaction_finished¶

SQL transaction was committed or rolled back.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Human readable error.
`error_code`	Error code (if available).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

sql_connection_finished¶

Connection to SQL server is closed.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

SMTP Server¶

These events are emitted by Dovecot’s internal lib-smtp library.

smtp_server_command_started¶

The command is received from the client.

View Event Fields

Field	Description
`cmd_args`	SMTP command’s full parameters (e.g. `<from@example.com>`). New in version 2.3.18.
`cmd_human_args`	SMTP command’s full parameters, as human-readable output. For SMTP, this is currently identical to `cmd_args`. New in version 2.3.18.
`cmd_input_name`	SMTP command name exactly as sent (e.g. `MaIL`) regardless of whether or not it is valid. New in version 2.3.9.
`cmd_name`	Name of the command. New in version 2.3.9.
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

smtp_server_command_finished¶

The command is finished. Either a success reply was sent for it or it failed somehow.

View Event Fields

Field	Description
`cmd_args`	SMTP command’s full parameters (e.g. `<from@example.com>`). New in version 2.3.18.
`cmd_human_args`	SMTP command’s full parameters, as human-readable output. For SMTP, this is currently identical to `cmd_args`. New in version 2.3.18.
`cmd_input_name`	SMTP command name exactly as sent (e.g. `MaIL`) regardless of whether or not it is valid. New in version 2.3.9.
`cmd_name`	Name of the command. New in version 2.3.9.
`duration`	Duration of the event (in microseconds)
`enhanced_code`	SMTP enhanced status code for the (first) reply. This is “9.0.0” for aborted commands (e.g., when the connection is closed prematurely).
`error`	Error message for the reply. There is no field for a success message.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`status_code`	SMTP status code for the (first) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).

Transaction¶

smtp_server_transaction_started¶

The transaction is started.

View Event Fields

Field	Description
`data_size`	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
`duration`	Duration of the event (in microseconds)
`mail_from`	Sender address.
`mail_param_auth`	The value of the AUTH parameter for the MAIL command.
`mail_param_body`	The value of the BODY parameter for the MAIL command.
`mail_param_envid`	The value of the ENVID parameter for the MAIL command.
`mail_param_ret`	The value of the RET parameter for the MAIL command.
`mail_param_size`	The value of the SIZE parameter for the MAIL command.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`session`	Session ID for this transaction (same as `transaction_id`). New in version 2.3.18.
`transaction_id`	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the “Received:” header). It is based on the connection_id with a “:<seq>” sequence number suffix.

smtp_server_transaction_finished¶

Transaction is finished or failed.

View Event Fields

Field	Description
`data_size`	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
`duration`	Duration of the event (in microseconds)
`enhanced_code`	SMTP enhanced status code for the (first failure) reply. This is “9.0.0” for aborted transactions (e.g., when the connection is closed prematurely).
`error`	Error message for the first failure reply. There is no field for a success message.
`is_reset`	The transaction was reset (RSET) rather than finishing with a DATA/BDAT command as it normally would. This happens when client side issues the RSET command. Note that a reset event is a success (no error field is present).
`mail_from`	Sender address.
`mail_param_auth`	The value of the AUTH parameter for the MAIL command.
`mail_param_body`	The value of the BODY parameter for the MAIL command.
`mail_param_envid`	The value of the ENVID parameter for the MAIL command.
`mail_param_ret`	The value of the RET parameter for the MAIL command.
`mail_param_size`	The value of the SIZE parameter for the MAIL command.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`recipients`	Total number of recipients.
`recipients_aborted`	The number of recipients that got aborted before these could either finish or fail. This means that the transaction failed early somehow while these recipients were still being processed by the server.
`recipients_denied`	The number of recipients denied by the server using a negative reply to the RCPT command.
`recipients_failed`	The number of recipients that failed somehow (includes denied recipients, but not aborted recipients).
`recipients_succeeded`	The number of recipients for which the transaction finally succeeded.
`session`	Session ID for this transaction (same as `transaction_id`). New in version 2.3.18.
`status_code`	SMTP status code for the (first failure) reply. This is = 9000 for aborted transactions (e.g., when the connection is closed prematurely).
`transaction_id`	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the “Received:” header). It is based on the connection_id with a “:<seq>” sequence number suffix.

Recipient¶

smtp_server_transaction_rcpt_finished¶

The transaction is finished or failed for this particular recipient. When successful, this means the DATA command for the transaction yielded success for that recipient (even for SMTP this event is generated for each recipient separately). Recipients can fail at various stages, particularly at the actual RCPT command where the server can deny the recipient.

View Event Fields

Field	Description
`dest_host`	LMTP proxying only: Proxy destination hostname New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`dest_ip`	LMTP proxying only: Proxy destination IP address New in version 2.4.0 (CE). New in version 3.0.0 (Pro).
`duration`	Duration of the event (in microseconds)
`enhanced_code`	SMTP enhanced status code for the reply. This is “9.0.0” for aborted transactions (e.g., when the connection is closed prematurely).
`error`	Error message for the reply if it is a failure. There is no field for a success message.
`rcpt_param_notify`	The value of the NOTIFY parameter for the RCPT command.
`rcpt_param_orcpt`	The address value of the ORCPT parameter for the RCPT command.
`rcpt_param_orcpt_type`	The address type (typically “rfc822”) of the ORCPT parameter for the RCPT command.
`rcpt_to`	Recipient address.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`session`	Session ID for this transaction and recipient. It is based on the `transaction_id` with a “:<seq>” recipient sequence number suffix. Only available for LMTP currently.
`status_code`	SMTP status code for the reply. This is = 9000 for aborted transactions (e.g., when the connection is closed prematurely).

SMTP Submit¶

These events are emitted by Dovecot’s internal lib-smtp library when sending mails.

smtp_submit_started¶

Started message submission.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

smtp_submit_finished¶

Finished the message submission.

View Event Fields

Field	Description
`data_size`	The size of the outgoing message.
`duration`	Duration of the event (in microseconds)
`error`	Error message for submission failure.
`mail_from`	The envelope sender for the outgoing message.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`recipients`	The number of recipients for the outgoing message.

Push Notifications¶

push_notification_finished¶

Push notification event was sent. See Push notifications

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Mailbox for event. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

Pigeonhole¶

Sieve Runtime¶

sieve_runtime_script_started¶

New in version 2.3.9.

Started evaluating a Sieve script.

View Event Fields

Field	Description
`binary_path`	The path of the Sieve binary being executed (if it is not only in memory).
`duration`	Duration of the event (in microseconds)
`error`	If present, this field indicates that the script execution has failed. The error message itself is very simple.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The full location string of the Sieve script.
`script_name`	The name of the Sieve script as it is visible to the user.

sieve_runtime_script_finished¶

New in version 2.3.9.

Finished evaluating a Sieve script.

View Event Fields

Field	Description
`binary_path`	The path of the Sieve binary being executed (if it is not only in memory).
`duration`	Duration of the event (in microseconds)
`error`	If present, this field indicates that the script execution has failed. The error message itself is very simple.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The full location string of the Sieve script.
`script_name`	The name of the Sieve script as it is visible to the user.

Sieve Action¶

sieve_action_finished¶

New in version 2.3.9.

Emitted when sieve action is completed successfully.

View Event Fields

Field

Description

action_name

Action	Description
`discard`	The discard action was executed successfully (only has an effect when no explicit keep is executed).
`fileinto`	The fileinto action was executed successfully.
`keep`	The keep action was executed successfully (maps to fileinto internally, so the fields are identical).
`notify`	The notify action was executed successfully (either from the notify or the enotify extension).
`pipe`	The pipe action (from vnd.dovecot.pipe extension) was executed successfully.
`redirect`	The redirect action was executed successfully.
`reject`	The reject action was executed successfully.
`report`	The report action (from vnd.dovecot.report extension) was executed successfully.
`vacation`	The vacation action was executed successfully.

action_script_location

The location string for this Sieve action (a combination of “<script-name>: line <number>”.

duration

Duration of the event (in microseconds)

fileinto_mailbox

The target mailbox for the fileinto/keep action.

mail_from

Envelope sender address if available.

message_id

The message-id of the message being filtered.

notify_target

The list of target addresses for the notify action.

pipe_program

The name of the program being executed by the pipe action.

rcpt_to

Envelope recipient address if available.

reason_code

List of reason code strings why the event happened. See Event Reasons for possible values.

redirect_target

The target address for the redirect action.

report_target

The target address for the report action.

report_type

The feedback type for the report action.

Sieve Storage¶

Events emitted by sieve storage.

sieve_script_opened¶

New in version 2.3.9.

Opened a Sieve script for reading (e.g. for ManageSieve GETSCRIPT or compiling it at delivery).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message for when storage operation has failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The location string for the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).

sieve_script_closed¶

New in version 2.3.9.

Closed a Sieve script (after reading it).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message for when storage operation has failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The location string for the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).

sieve_script_deleted¶

New in version 2.3.9.

Deleted a Sieve script.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message for when storage operation has failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The location string for the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).

sieve_script_activated¶

New in version 2.3.9.

Activated a Sieve script.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message for when storage operation has failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The location string for the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).

sieve_script_renamed¶

New in version 2.3.9.

Renamed a Sieve script.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message for when storage operation has failed.
`new_script_name`	New name for the Sieve script.
`old_script_name`	Old name of the Sieve script.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The location string for the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).

sieve_storage_save_started¶

New in version 2.3.9.

Started saving a Sieve script.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message for when storage operation has failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The location string for the Sieve script.
`script_name`	Name of the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).

sieve_storage_save_finished¶

New in version 2.3.9.

Finished saving a Sieve script.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message for when storage operation has failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_location`	The location string for the Sieve script.
`script_name`	Name of the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).

ManageSieve¶

Events emitted by the ManageSieve process.

managesieve_command_finished¶

Finished the ManageSieve command.

View Event Fields

Field	Description
`cmd_name`	Arguments for the ManageSieve command.
`compile_errors`	The number of compile errors that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when compile fails).
`compile_warnings`	The number of compile warnings that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when script is compiled).
`duration`	Duration of the event (in microseconds)
`error`	Error message for when the command failed.
`new_script_name`	New name for the Sieve script (only set for RENAMESCRIPT).
`old_script_name`	Old name of the Sieve script (only set for RENAMESCRIPT).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`script_name`	Name for the Sieve script this command operated on (if any).

obox¶

obox plugin¶

Index merging¶

Events emitted by the new index merging ( metacache_index_merging = v2).

obox_index_merge_started¶

Mailbox index merging was started.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

obox_index_merge_finished¶

Mailbox index merging was finished.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

obox_index_merge_uidvalidity_changed¶

Index merging required changing the mailbox’s IMAP UIDVALIDITY.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

obox_index_merge_uids_renumbered¶

Index merging required changing some mails’ IMAP UIDs because they conflicted between the two indexes.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`renumber_count`	Number of UIDs that were renumbered.

obox_index_merge_skip_uid_renumbering¶

Index merging should have renumbered UIDs due to conflicts, but there were too many of them (more than metacache_merge_max_uid_renumbers), so no renumbering was done after all.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`renumber_count`	Number of UIDs that should have been renumbered.

lib-metacache¶

Events emitted by the metacache library.

metacache_user_refresh_started¶

New in version 2.3.11.

Metacache is being refreshed when user is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn’t sent if the metacache is used without refreshing.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the refresh failed.
`metacache_status`	Status of the refresh operation: refreshed_changed: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. refreshed_unchanged: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rescan`	`yes`, if mailbox is going to be rescanned.
`user`	Username of the user.

metacache_user_refresh_finished¶

New in version 2.3.11.

Metacache was refreshed when user is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn’t sent if the metacache is used without refreshing.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the refresh failed.
`metacache_status`	Status of the refresh operation: refreshed_changed: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. refreshed_unchanged: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rescan`	`yes`, if mailbox is going to be rescanned.
`user`	Username of the user.

metacache_mailbox_refresh_started¶

New in version 2.3.11.

Metacache is being refreshed when mailbox is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn’t sent if the metacache is used without refreshing.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the refresh failed.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`metacache_status`	Status of the refresh operation: refreshed_changed: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. refreshed_unchanged: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rescan`	`yes`, if mailbox is going to be rescanned.

metacache_mailbox_refresh_finished¶

New in version 2.3.11.

Metacache was refreshed when mailbox is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn’t sent if the metacache is used without refreshing.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the refresh failed.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`metacache_status`	Status of the refresh operation: refreshed_changed: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. refreshed_unchanged: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rescan`	`yes`, if mailbox is going to be rescanned.

metacache_user_bundle_download_started¶

New in version 2.3.11.

User index bundle file is being downloaded (can happen while the user is being refreshed).

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the download failed.
`filename`	Bundle filename.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

metacache_user_bundle_download_finished¶

New in version 2.3.11.

User index bundle file was downloaded (can happen while the user is being refreshed).

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the download failed.
`filename`	Bundle filename.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

metacache_mailbox_bundle_download_started¶

New in version 2.3.11.

Mailbox index bundle file is being downloaded (can happen while the mailbox is being refreshed).

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the download failed.
`filename`	Bundle filename.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

metacache_mailbox_bundle_download_finished¶

New in version 2.3.11.

Mailbox index bundle file was downloaded (can happen while the mailbox is being refreshed).

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the download failed.
`filename`	Bundle filename.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

metacache_upload_started¶

New in version 2.3.11.

Changes in metacache are being uploaded to storage.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

metacache_upload_finished¶

New in version 2.3.11.

Changes in metacache were uploaded to storage.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

metacache_user_bundle_upload_started¶

New in version 2.3.11.

User index bundle file is being uploaded. Can happen while the user is being uploaded.

Note

This event can be inherited from a mailbox event, and include the mailbox fields, if the user upload was triggered by a mailbox upload.

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`filename`	Bundle filename.
`mailbox`	Full mailbox name in UTF-8. New in version 2.3.9.
`mailbox_guid`	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
`mailbox_guid`	Mailbox GUID with obox storage. New in version 2.3.10.
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

metacache_user_bundle_upload_finished¶

New in version 2.3.11.

User index bundle file was uploaded. Can happen while the user is being uploaded.

Note

This event can be inherited from a mailbox event, and include the mailbox fields, if the user upload was triggered by a mailbox upload.

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`filename`	Bundle filename.
`mailbox_guid`	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

metacache_mailbox_bundle_upload_started¶

New in version 2.3.11.

Mailbox index bundle file is being uploaded. Can happen while the mailbox is being uploaded.

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`filename`	Bundle filename.
`mailbox_guid`	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

metacache_mailbox_bundle_upload_finished¶

New in version 2.3.11.

Mailbox index bundle file was uploaded. Can happen while the mailbox is being uploaded.

View Event Fields

Field	Description
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`filename`	Bundle filename.
`mailbox_guid`	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

metacache_user_clean_started¶

New in version 2.3.11.

User is started to be cleaned from metacache, either entirely or only partially (only low priority files).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`min_priority`	Which priority indexes are being cleaned.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

metacache_user_clean_finished¶

New in version 2.3.11.

User is finished being cleaned from metacache.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the upload failed.
`min_priority`	Which priority indexes are being cleaned.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username of the user.

metacache_pull_started¶

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if metacache pull failed.
`exit_code`	Exit code for finished metacache pull commands. If the command finished successfully it is `0`. The exit codes are the same as doveadm exit codes. See Doveadm Error/Exit Codes fore more details on the exit codes.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`source_host`	Which host metacache is being pulled from.
`type`	`server`: the event is emitted by the host that metacache is being pulled from. (This host is `source_host`.) `client`: the event is emitted by the host that is pulling metacache from `source_host`.

metacache_pull_finished¶

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if metacache pull failed.
`exit_code`	Exit code for finished metacache pull commands. If the command finished successfully it is `0`. The exit codes are the same as doveadm exit codes. See Doveadm Error/Exit Codes fore more details on the exit codes.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`source_host`	Which host metacache is being pulled from.
`type`	`server`: the event is emitted by the host that metacache is being pulled from. (This host is `source_host`.) `client`: the event is emitted by the host that is pulling metacache from `source_host`.

obox_mailbox_rescan_started¶

New in version 2.3.11.

Mailbox is being rescanned. A rescan happens when a mailbox is opened for the first time in this backend (or after it was cleaned away). All mails in the storage are listed and synced against the local indexes in metacache.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the rescan/rebuild failed.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to “Object exists in dict, but not in storage”.
`mails_total`	Number of mails that exists in the mailbox now.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

obox_mailbox_rescan_finished¶

New in version 2.3.11.

Mailbox was rescanned. A rescan happens when a mailbox is opened for the first time in this backend (or after it was cleaned away). All mails in the storage are listed and synced against the local indexes in metacache.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the rescan/rebuild failed.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to “Object exists in dict, but not in storage”.
`mails_total`	Number of mails that exists in the mailbox now.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

obox_mailbox_rebuild_started¶

New in version 2.3.11.

Mailbox is being rebuilt. A rebuild happens after some kind of corruption had been detected. All mails in the storage are listed and synced against the local indexes in metacache.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the rescan/rebuild failed.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to “Object exists in dict, but not in storage”.
`mails_total`	Number of mails that exists in the mailbox now.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

obox_mailbox_rebuild_finished¶

New in version 2.3.11.

Mailbox was rebuilt. A rebuild happens after some kind of corruption had been detected. All mails in the storage are listed and synced against the local indexes in metacache.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error message if the rescan/rebuild failed.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to “Object exists in dict, but not in storage”.
`mails_total`	Number of mails that exists in the mailbox now.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

obox_save_throttling¶

New in version 2.4.0 (CE).

New in version 3.0.0 (Pro).

Obox is throttling the number of concurrent saves/copies.

This event is used to expose externally the status of the internal parallelism, i.e. to let tests asses if we can actually reach the degree of parallelism expected through obox_max_parallel_writes and obox_max_parallel_copies or instead anything chokes the performance to less optimal levels.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`pending_copy`	Number of message copies pending completion.
`pending_save`	Number of message saves pending completion.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

fs-dictmap¶

fs_dictmap_dict_write_uncertain¶

New in version 2.3.13.

A dictionary write is uncertain (e.g., writes to Cassandra may eventually succeed even if the write initially appeared to fail).

See also fs_object_write_uncertain event.

View Event Fields

Field	Description
`cleanup`	`success`, `failed` or `disabled`. Indicates if uncertain write was attempted to be cleaned (deleted) and whether it was successful. See Dictmap Parameters.
`duration`	Duration of the event (in microseconds)
`error`	Error message why the write initially failed.
`object_id`	Object ID in the storage.
`path`	Virtual FS path to the object (based on dict).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

fs_dictmap_object_lost¶

New in version 2.3.10.

“Object exists in dict, but not in storage” error happened.

Normally this shouldn’t happen, because the writes and deletes are done in such an order that Dovecot prefers to rather leak objects in storage than cause this error. A likely source of this error can be resurrected deleted data (see Cassandra for more details).

View Event Fields

Field	Description
`deleted`	Set to `yes`, if the corresponding entry in dict has been deleted as the `delete-dangling-links` option was set (Dictmap Parameters). New in version 2.3.15.
`duration`	Duration of the event (in microseconds)
`object_id`	Object ID in the storage.
`path`	Virtual FS path to the object (based on dict).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

fs_dictmap_max_bucket_changed¶

New in version 2.3.13.

This event is sent whenever the max_bucket value for a mailbox changes. There can be three situations when this happens.

A new mail is added to a mailbox, where the current bucket is found to be filled and the next bucket is started to be filled (reason = file).

Besides the expected situation, Dovecot emits this event if it encounters a bucket with a higher index then the current max_bucket while iterating a mailbox (reason = iter).

Changed in version 2.3.14: In addition max_bucket can be shrunk in case an iteration discovers empty buckets before the current max_bucket value (reason = iter).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Error string if error occurred. Only set if setting the new `max_bucket` value failed.
`max_bucket`	The newly set `max_bucket` value.
`old_max_bucket`	The `max_bucket` value for the current mailbox, before the event was emitted.
`reason`	Either `file` or `iter` depending on the source of the event.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

fs_dictmap_empty_bucket_iterated¶

New in version 2.3.14.

Nn empty bucket is found while iterating which is not the last bucket.

View Event Fields

Field	Description
`deleted_count`	The count of deleted keys for the empty bucket.
`duration`	Duration of the event (in microseconds)
`empty_bucket`	Index of the empty bucket that was just discovered.
`max_bucket`	The current `max_bucket` value.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

fs_object_write_uncertain¶

New in version 2.4.0 (CE).

New in version 3.0.0 (Pro).

Sent whenever an object write is uncertain.

When a write HTTP operation times out actual outcome is uncertain.

See also fs_dictmap_dict_write_uncertain event.

View Event Fields

Field	Description
`cleanup`	`success` or `failed`. Indicates if uncertain write was cleaned (deleted) successfully \|
`duration`	Duration of the event (in microseconds)
`error`	Error message why the write initially failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

Dictionaries¶

Events emitted by dictionary library and dictionary server.

dict_created¶

New in version 2.3.17.

Dictionary is initialized.

View Event Fields

Field	Description
`dict_name`	Name of the dict as set in configurations.
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

dict_destroyed¶

New in version 2.3.17.

Dictionary is destroyed.

View Event Fields

Field	Description
`dict_name`	Name of the dict as set in configurations.
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

dict_lookup_finished¶

New in version 2.3.11.

Dictionary lookup finishes.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`key`	Key name, starts with `priv/` or `shared/`.
`key_not_found`	Set to `yes` if key not found.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username, if it’s not empty.

dict_iteration_finished¶

New in version 2.3.11.

Dictionary iteration finished.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rows`	Number of rows returned.

dict_transaction_finished¶

New in version 2.3.11.

Dictionary transaction has been committed or rolled back.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rollback`	Set to `yes` when transaction was rolled back.
`user`	Username, if it’s not empty.
`write_uncertain`	Set to `yes` if write was not confirmed.

dict_server_lookup_finished¶

New in version 2.3.11.

Dictionary server finishes lookup.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`key`	Key name, starts with `priv/` or `shared/`.
`key_not_found`	Set to `yes` if key not found.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username, if it’s not empty.

dict_server_iteration_finished¶

New in version 2.3.11.

Dictionary server finishes iteration.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rows`	Number of rows returned.

dict_server_transaction_finished¶

New in version 2.3.11.

Dictionary server finishes transaction.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`rollback`	Set to `yes` when transaction was rolled back.
`user`	Username, if it’s not empty.
`write_uncertain`	Set to `yes` if write was not confirmed.

Login¶

login_aborted¶

New in version 2.4.0 (CE).

New in version 3.0.0 (Pro).

View Event Fields

Field	Description
`auth_attempts`	Total number of authentication attempts, both successful and failed.
`auth_successes`	Number of successful authentications, which eventually failed due to other reasons.
`auth_usecs`	How long ago the first authentication attempt was started.
`connected_usecs`	How long ago the client connection was created.
`duration`	Duration of the event (in microseconds)
`local_ip`	Local IP address.
`local_port`	Local port.
`reason`	Short reason, see the short to long reason mapping in the table below.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`remote_ip`	Remote IP address.
`remote_port`	Remote port.
`service`	Name of service e.g. `submission`, `imap`.
`user`	Full username.

Reason	Description
`anonymous_auth_disabled`	Anonymous authentication is not allowed.
`authorization_failed`	Master user authentication succeeded, but authorization to access the requested login user wasn’t allowed.
`auth_aborted_by_client`	Client started SASL authentication, but returned “*” reply to abort it.
`auth_failed`	Generic authentication failure. Possibly due to invalid username/password, but could have been some other unspecified reason also.
`auth_nologin_referral`	Authentication returned auth referral to redirect the client to another server. This is normally configured to be sent only when the client is a Dovecot proxy, which handles the redirection.
`auth_process_comm_fail`	Internal error communicating with the auth process.
`auth_process_not_ready`	Client disconnected before auth process was ready. This may indicate a hanging auth process if `connected_usecs` is large.
`auth_waiting_client`	Client started SASL authentication, but disconnected instead of sending the next SASL continuation reply.
`cleartext_auth_disabled`	Authentication using cleartext mechanism is not allowed at this point. It would be allowed if SSL/TLS was enabled.
`client_ssl_cert_untrusted`	Client sent an SSL certificate that is untrusted with `auth_ssl_require_client_cert` set to `yes`
`client_ssl_cert_missing`	Client didn’t send SSL certificate, but `auth_ssl_require_client_cert` is set to `yes`
`client_ssl_not_started`	Client didn’t even start SSL with `auth_ssl_require_client_cert` set to `yes`
`internal_failure`	Internal failure. The error log has more details.
`invalid_base64`	Client sent invalid base64 in SASL response.
`invalid_mech`	Unknown SASL authentication mechanism requested.
`login_disabled`	The user has the nologin field set in passdb and is thereby not able to login.
`no_auth_attempts`	Client didn’t send any authentication attempts.
`password_expired`	The user’s password is expired.
`process_full`	client_limit and process_limit was hit and this login session was killed.
`shutting_down`	The process is shutting down so the login is aborted.
`user_disabled`	User is in deny passdb, or in some other way disabled passdb.

** Proxying error codes **

Reason	Description
`proxy_dest_connect_failed`	Local authentication succeeded, but connection to destination hop failed.
`proxy_dest_internal_failure`	Local authentication succeeded, but internal failure occurred after that.
`proxy_dest_remote_failure`	Local authentication succeeded, but destination hop reported unspecified failure.
`proxy_dest_protocol_failure`	Local authentication succeeded, but destination hop unexpectedly violated the protocol standard.
`proxy_dest_auth_failed`	Local authentication succeeded, but proxying failed to authenticate to the destination hop.
`proxy_dest_auth_temp_failed`	Local authentication succeeded, but proxying failed to temporarily authenticate to the destination hop.
`proxy_dest_redirected`	Local authentication succeeded, but destination hop redirected to another host.

Login Proxy¶

Events emitted when login process proxies a connection to a backend.

proxy_session_started¶

New in version 2.3.18.

Connection to proxy destination has started.

View Event Fields

Field	Description
`dest_host`	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as `dest_ip`).
`dest_ip`	Proxy destination IP.
`dest_port`	Proxy destination port.
`duration`	Duration of the event (in microseconds)
`master_user`	If proxying is done with a master user authentication, contains the full username of master user.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`source_ip`	Source IP where proxy connection originated from.

proxy_session_established¶

New in version 2.3.18.

Connection to proxy destination is established and user is successfully logged into the backend.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`reconnect_attempts`	Number of times connection failed and reconnection was attempted.
`source_port`	Source port where proxy connection originated from.

proxy_session_finished¶

New in version 2.3.18.

Connection to proxy destination has ended, either successfully or with error.

List of error codes

View Event Fields

Field	Description
`disconnect_reason`	Reason for disconnection (empty = clean disconnect).
`disconnect_side`	Which side disconnected: `client`, `server`, `proxy`.
`duration`	Duration of the event (in microseconds)
`error`	If login to destination failed, contains the error.
`error_code`	If login to destination failed, contains the error_code.
`idle_usecs`	Number of seconds the connection was idling before getting disconnected. .. dovecotchanged:: 2.4.0,3.0.0 This was previously named idle_secs.
`net_in_bytes`	Amount of data read from client, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`net_out_bytes`	Amount of data written to client, in bytes. Changed in version 2.4.0 (CE). Changed in version 3.0.0 (Pro).
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`reconnect_attempts`	Number of times connection failed and reconnection was attempted.
`source_port`	Source port where proxy connection originated from.

`error_code`	explanation
`authorization_failed`	User authorization failed.
`temp_fail`	Auth service reported temporary failure.
`user_disabled`	User is disabled.
`password_expired`	Password is expired.
`invalid_base64`	Challenge response was invalid BASE64.
`login_disabled`	Login is disabled.
`invalid_mech`	Used mechanism isn’t supported.
`cleartext_auth_disabled`	Cleartext authentication is not enabled, use TLS.
`anonymous_auth_disabled`	Anonymous authentication is not enabled.

Additionally proxying errors can occur.

FTS-Dovecot¶

lib-fts-index¶

fts_dovecot_too_many_triplets¶

New in version 2.3.15.

Emitted when number of triplets exceeds the limit defined by fts_dovecot_max_triplets.

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`triplet_count`	Number of triplets found.
`user`	Username of the user.

Cluster¶

cluster¶

cluster_user_group_move_started¶

New in version 3.0.0 (Pro).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`group`	User group name.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

cluster_user_group_move_finished¶

New in version 3.0.0 (Pro).

View Event Fields

Field	Description
`duration`	Duration of the event (in microseconds)
`error`	Reason why group moving (partially) failed.
`failed_users`	Number of users whose moving failed.
`group`	User group name.
`moved_users`	Number of users moved successfully within this group.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

cluster_user_move_started¶

New in version 3.0.0 (Pro).

View Event Fields

Field	Description
`dest_host`	Destination host where user is being moved to.
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username being moved.

cluster_user_move_finished¶

New in version 3.0.0 (Pro).

View Event Fields

Field	Description
`dest_host`	Destination host where user is being moved to.
`duration`	Duration of the event (in microseconds)
`error`	Reason why user moving failed.
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`user`	Username being moved.

cluster_backend_check_started¶

New in version 3.0.0 (Pro).

Sent when a backend’s health check is started.

View Event Fields

Field	Description
`backend_host`	Backend host
`backend_id`	Backend ID being checked.
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.

cluster_backend_check_finished¶

New in version 3.0.0 (Pro).

Sent when a backend’s health check is finished.

View Event Fields

Field	Description
`backend_host`	Backend host
`backend_id`	Backend ID being checked.
`duration`	Duration of the event (in microseconds)
`error`	Set if the check failed due to an internal error
`reason`	Reason why the check passed or failed
`reason_code`	List of reason code strings why the event happened. See Event Reasons for possible values.
`status`	Backend status after the check: `online` or `offline`