Events

List of all events emitted by Dovecot for statistics, exporting and filtering.

See also:

• Statistics

• Event Reasons

• Event Export

• Event Filtering

• Events Design for technical implementation details

Categories

Root Categories

Category	Description
auth	Authentication (server mainly)
auth-client	Authentication client library
dict	Dictionary library and drivers
dict-server	Dictionary server/proxy (dict process)
dns	DNS client library
dns-worker	dns-client process
fs	FS library
fts	Full text search plugin
fts-dovecot	Dovecot Pro FTS Engine
http-client	HTTP client library New in version v2.3.16.
http-server	HTTP server library
imap	imap process
imap-urlauth	imap-urlauth process
imap-hibernate	imap-hibernate process
lda	dovecot-lda process
local-delivery	LDA/LMTP local delivery
lmtp	LMTP process
lua	Lua script
mail-cache	dovecot.index.cache file handling
mail-index	dovecot.index* file handling
managesieve	Managesieve
metacache	obox metacache
push-notification	push-notification plugin Changed in version v2.3.11: This was previously named push_notification.
quota-status	quota-status process
service:<name>	Named service, e.g. service:imap or service:auth
smtp-client	SMTP/LMTP client
smtp-server	SMTP/LMTP server
smtp-submit	SMTP submission client

Storage Categories

Category	Description
storage	Mail storage parent category
cydir	cydir storage
mdbox	mdbox storage
sdbox	sdbox storage
imapc	imapc storage
maildir	maildir storage
mbox	mbox storage
pop3c	pop3c storage
mailbox	Mailbox (folder)

Mailbox Categories

Category	Description
storage	Mailbox (folder) parent category
mail	Mail

Sieve Categories

New in version v2.3.11: makes the “sieve” category parent for the other sieve-* categories.

Category	Description
sieve	Sieve parent category
sieve-action	Individual Sieve actions executed.
sieve-execute	Sieve script(s) being executed for a particular message. This envelops all of Sieve execution; both runtime and action execution.
sieve-runtime	Evaluation of individual Sieve scripts.
sieve-storage	Sieve storage

SQL Categories

Category	Description
sql	SQL parent category
cassandra	Cassandra CQL events.
mysql	MySQL events.
pgsql	PostgreSQL events.
sqlite	SQLite events.
sqlpool	SQL is used internally via “SQL connection pools”

Global Fields

ALL events may have the following fields:

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See Event Reasons for possible values.

Dovecot Core

Authentication Client

auth_client_cache_flush_started

no particular fields

auth_client_cache_flush_finished

Field	Description
error	Error string if error occurred.

Common fields

These fields are common for the rest of the authentication client events.

Field | Description
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Service name, such as imap3, pop3, lmtp.
transport	Transport security indicator (insecure, TLS, trusted).
session	Session identifier.
certificate_user	Username from certificate
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain=yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_passdb_lookup_started

auth_client_passdb_lookup_finished

Field | Description
user	User to lookup.
error	Error string if error occurred.

auth_client_request_started

auth_client_request_challenged

auth_client_request_continued

auth_client_request_finished

Field | Description
user	Username, if present.
original_user	Original username, if present.
auth_user	Auth username, if present.
error	Error string if error occurred.

auth_client_userdb_list_started

Field	Description
user_mask	User mask to list.

auth_client_userdb_list_finished

Field	Description
user_mask	User mask to list.
error	Error string if error occurred.

auth_client_userdb_lookup_started

auth_client_userdb_lookup_finished

Field | Description
user	User to lookup.
error	Error string if error occurred.

Authentication Server

These events are generated in authentication process(es) and can be used to track and log individual authentication actions.

Common fields

Field	Description
user	Full username. This can change during authentication, for example due to passdb lookups.
original_user	Original username exactly as provided by the client.
translated_user	Similar to original_user, except after auth_username_translation translations are applied.
login_user	When doing a master user login, the user we are logging in as. Otherwise not set.
master_user	When doing a master user login, the master username. Otherwise not set.
mechanism	Name of used SASL mechanism (e.g. PLAIN) New in version v2.3.12.
service	Service doing the lookup (e.g. imap, pop3) New in version v2.3.12.
session	Session ID New in version v2.3.12.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain=yes New in version v2.3.12.
remote_ip	Remote IP address of the client connection New in version v2.3.12.
local_ip	Local IP address where client connected to New in version v2.3.12.
remote_port	Remote port of the client connection New in version v2.3.12.
local_port	Local port where the client connected to New in version v2.3.12.
real_remote_ip	Same as remote_ip, except if the connection was proxied, this is the proxy’s IP address. New in version v2.3.12.
real_local_ip	Same as local_ip, except if the connection was proxied, this is the IP where proxy connected to. New in version v2.3.12.
real_remote_port	Same as remote_port, except if the connection was proxied, this is the proxy connection’s port. New in version v2.3.12.
real_local_port	Same as remote_port, except if the connection was proxied, this is the local port where the proxy connected to. New in version v2.3.12.
local_name	TLS SNI hostname, if given New in version v2.3.12.
transport	Client connection’s transport security. Values: insecure trusted TLS

auth_request_finished

New in version v2.3.7.

Emitted at end of authentication request. Most useful for tracking status of authentication/login attempts.

Field	Description
error	Set when error happens
success	yes, when authentication succeeded
policy_penalty	Time of penalty added by policy server
policy_result	Values: ok delayed refused

auth_passdb_request_started

New in version v2.3.7.

Emitted before processing begins for a passdb block.

Most useful for debugging authentication flow.

Field	Description
passdb	Driver name
passdb_name	passdb { name }, if it is configured. Otherwise, the driver name.
passdb_id	Internal ID number of the passdb. May be useful to identify the passdb if it has no name. New in version v2.3.9.

auth_passdb_request_finished

New in version v2.3.7.

Emitted after processing ends for a passdb block.

Most useful for debugging authentication flow.

Field	Description
passdb	Driver name
passdb_name	passdb { name }, if it is configured. Otherwise, the driver name.
passdb_id	ID number of the passdb username New in version v2.3.9.
result	Values: ok password_mismatch user_unknown pass_expired user_disabled scheme_not_available internal_failure next
cache	hit or miss when auth cache was used. New in version v2.3.19.

auth_userdb_request_started

New in version v2.3.7.

Emitted before processing begins for a userdb block.

Most useful for debugging authentication flow.

Field	Description
userdb	Driver name
userdb_name	userdb { name }, if it is configured. Otherwise, the driver name.
userdb_id	Internal ID number of the userdb. May be useful to identify the userdb if it has no name. New in version v2.3.9.

auth_userdb_request_finished

New in version v2.3.7.

Emitted after processing ends for a userdb block.

Most useful for debugging authentication flow.

Field	Description
userdb	Driver name
userdb_name	userdb { name }, if it is configured. Otherwise, the driver name.
userdb_id	ID number of the userdb username New in version v2.3.9.
result	Values: ok user_unknown internal_failure
cache	hit or miss when auth cache was used. New in version v2.3.19.

auth_policy_request_finished

New in version v2.3.7.

Emitted after processing ends for an auth policy request.

Most useful for debugging authentication flow.

Field	Description
mode	Values: allow report
policy_response	Value returned from policy server (number) Otherwise, the driver name.

Authentication Client

These events are generated by authentication clients (lib-auth).

auth_client_request_started

New in version v2.3.7.

Field	Description
id	Event ID

auth_client_request_continue

New in version v2.3.7.

Field	Description
id	Event ID

auth_client_request_finished

New in version v2.3.7.

Field	Description
id	Event ID
error	Error reason

auth_client_request_challenged

New in version v2.3.7.

Field	Description
id	Event ID

auth_client_userdb_lookup_started

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username

auth_client_userdb_lookup_finished

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username
error	Error, if it occurred

auth_client_passdb_lookup_started

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username

auth_client_passdb_lookup_finished

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username
error	Error, if it occurred

auth_client_userdb_list_started

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username

auth_client_userdb_list_finished

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username
error	Error, if it occurred

auth_client_cache_flush_started

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username

auth_client_cache_flush_finished

New in version v2.3.7.

Field	Description
service	Name of service. Examples: submission, imap, lmtp, …
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username
error	Error, if it occurred

Authentication Master Client

These events are generated by master authentication clients (lib-master). This happens when e.g. IMAP finishes the login by doing a userdb lookup.

Common fields:

Field	Description
id	Login request ID
local_ip	Client connection’s local (server) IP
local_port	Client connection’s local (server) port
remote_ip	Client connection’s remote (client) IP
remote_port	Client connection’s remote (client) port

auth_master_client_login_started

Authentication master login request started.

auth_master_client_login_finished

Authentication master login request finished.

Field	Description
user	Username of the user
error	Error message if the request failed

Connection

These events apply only for connections using the connection API.

Note

Not all connections currently use this API, so these events work for some types of connections, but not for others.

Common fields for client (incoming) connections

Fields present in all client_connection_* events.

Field	Description
local_ip	Local server IP address where TCP client connected to.
remote_ip	Remote TCP client’s IP address.
remote_port	Remote TCP client’s source port.
remote_pid	Remote UNIX socket client’s process ID.
remote_uid	Remote UNIX socket client’s system user ID.

Common fields for server (outgoing) connections

Fields present in all server_connection_* events.

Field	Description
source_ip	Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested.
dest_ip	TCP connection’s destination IP address.
dest_port	TCP connection’s destination port.
dest_host	TCP connection’s destination hostname, if known.
socket_path	UNIX socket connection’s path
remote_pid	Remote UNIX socket server’s process ID.
remote_uid	Remote UNIX socket server’s system user ID.

client_connection_connected

Emitted when a server accepts an incoming client connection.

client_connection_disconnected

Emitted when a client connection is terminated.

Field	Description
bytes_in	Amount of data read, in bytes
bytes_out	Amount of data written, in bytes
reason	Disconnection reason

server_connection_connected

Emitted when an outgoing server connection was either successfully established or failed. Currently it is not possible to know which one happened.

server_connection_disconnected

Emitted when a server connection is terminated.

Field	Description
bytes_in	Amount of data read, in bytes
bytes_out	Amount of data written, in bytes
reason	Disconnection reason

FS

fs

Field	Description
Inherits from environment (e.g. Mail user)

fs_file

Field	Description
Inherits from fs or any other specified event (e.g. Mail)

fs_file

Field	Description
Inherits from fs or any other specified event (e.g. Mailbox)

If the file was created for obox, it has also fields:

Field	Description
file_type	mail: Email file index: Index bundle box: Mailbox directory (for creating/deleting it, if used by the storage driver) fts: FTS file
reason	Reason for accessing the file

Storage

Mail storage service user

Field	Description
Inherits from environment (e.g. IMAP/LMTP client)
session	Session ID for the storage session

Mail user

Field	Description
Inherits from Mail storage service user
user	Username of the user

mail_user_session_finished

New in version v2.3.19.

Field	Description
Inherits from Mail user
utime	User CPU time used in microseconds
stime	System CPU time used in microseconds
minor_faults	Page reclaims (soft page faults)
major_faults	Page faults (hard page faults)
vol_cs	Voluntary context switches
invol_cs	Involuntary context switches
rss	Resident set size in bytes. (Skipped in non-Linux environments.)
vsz	Virtual memory size in bytes. (Skipped in non-Linux environments.)
rchar	I/O counter: chars (bytes) read from storage (Skipped in non-Linux environments.)
wchar	I/O counter: chars (bytes) written to storage (Skipped in non-Linux environments.)
syscr	Number of read syscalls (Skipped in non-Linux environments.)
syscw	Number of write syscalls (Skipped in non-Linux environments.)

Storage

Field	Description
Inherits from Mail user

Mailbox

Field	Description
Inherits from Storage
mailbox	Full mailbox name in UTF-8 New in version v2.3.9.
mailbox_guid	Mailbox GUID with obox storage New in version v2.3.10.

mail_expunged

New in version 2.3.15.

A mail was expunged from the mailbox. Note that this event inherits from mailbox, not mail.

Field	Description
uid	UID of the expunged mail.

Mail

Field	Description
Inherits from Mailbox
seq	Mail sequence number
uid	Mail IMAP UID number

mail_opened

New in version 2.3.15.

A mail was opened e.g. for reading its body. Note that this event is not sent when mails’ metadata is accessed, even if it causes opening the mail file.

Field	Description
reason	Reason why the mail was opened. (optional)

mail_expunge_requested

New in version 2.3.15.

A mail is set to be expunged. (Note that expunges can be rolled back later on, this event is emitted when an expunge is requested).

Mail index

Mail index

Index file handling for dovecot.index*, dovecot.map.index*, dovecot.list.index* and similar indexes.

Field	Description
Inherits from Mailbox, Storage or Mail user depending on what the index is used for.

mail_index_recreated

New in version 2.3.12.

A mail index file was recreated.

Field	Description
filepath	Path to the index file being recreated
reason	Reason why the mail index was recreated

indexer_worker_indexing_finished

New in version 2.3.15.

Indexer worker process completed an indexing transaction.

Field	Description
Inherits from Mailbox
message_count	Number of messages indexed
first_uid	UID of the first indexed message
last_uid	UID of the last indexed message
user_cpu_usecs	Total user CPU spent on the indexing transaction in microseconds.

Mail cache

New in version 2.3.11.

Field	Description
Inherits from Mail index

mail_cache_decision_changed

A field’s caching decision changed. The decisions are:

• no: The field is not cached.

• temp: The field is cached for 1 week and dropped on the next purge.

• yes: The field is cached permanently. If the field isn’t accessed for 30 days it’s dropped.

Field	Description
field	Cache field name (e.g. imap.body or hdr.from)
last_used	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.
reason	Reason why the caching decision changed: add: no -> temp decision change, because a new field was added to cache. old_mail: temp -> yes decision change, because a mail older than 1 week was accessed. unordered_access: temp -> yes decision change, because mails weren’t accessed in ascending order Other values indicate a reason for cache purging, which changes the caching decision yes -> temp.
uid	IMAP UID number that caused the decision change. This is set only for some reasons, not all.
old_decision	Old cache decision: no, temp, yes
new_decision	New cache decision: no, temp, yes

mail_cache_purge_started

Cache file purging is started.

Field	Description
file_seq	Sequence of the new cache file that is created.
prev_file_seq	Sequence of the cache file that is to be purged.
prev_file_size	Size of the cache file that is to be purged.
prev_deleted_records	Number of records (mails) marked as deleted in the cache file that is to be purged.
reason	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index

mail_cache_purge_drop_field

Existing field is dropped from the cache file because it hadn’t been accessed for 30 days.

Field	Description
All the same fields as in mail_cache_purge_started
field	Cache field name (e.g. imap.body or hdr.from)
decision	Old caching decision: temp, yes
last_used	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.

mail_cache_purge_finished

Cache file purging is finished.

Field	Description
All the same fields as in mail_cache_purge_started
file_size	Size of the new cache file.
max_uid	IMAP UID of the last mail in the cache file.

mail_cache_corrupted

Cache file was found to be corrupted and the whole file is deleted.

Field	Description
reason	Reason string why cache was found to be corrupted.

mail_cache_record_corrupted

Cache record for a specific mail was found to be corrupted and the record is deleted.

Field	Description
uid	IMAP UID of the mail whose cache record is corrupted.
reason	Reason string why cache was found to be corrupted.

mail_cache_lookup_finished

New in version 2.3.15.

Removed in version 2.3.18: Removed for performance reasons.

A mail field was looked up from cache.

Field	Description
field	Cache field name e.g. imap.body or hdr.from

HTTP Client

These events are emitted by Dovecot’s internal HTTP library when acting as a client to an external service.

Common fields

Fields present in all HTTP client events.

Field	Description
attempts	Amount of individual HTTP request attempts. (number of retries after failures + 1)
bytes_in	Amount of data read, in bytes.
bytes_out	Amount of data written, in bytes.
dest_host	Destination host.
dest_ip	Destination IP address.
dest_port	Destination port.
method	HTTP verb used uppercased, e.g. GET.
redirects	Number of redirects done while processing request.
status_code	HTTP result status code (integer).
target	Request path with parameters, e.g. /path/?delimiter=%2F&prefix=test%2F.

http_request_finished

Emitted when an HTTP request is complete.

This event is useful to track and monitor external services.

http_request_redirected

Intermediate event emitted when an HTTP request is being redirected.

The http_request_finished event is still sent at the end of the request.

http_request_retried

Intermediate event emitted when an HTTP request is being retried.

The http_request_finished event is still sent at the end of the request.

HTTP Server

These events are emitted by Dovecot’s internal HTTP library when serving requests (e.g. doveadm HTTP API).

Common fields

Fields present in all HTTP server events.

Field	Description
Inherits from Common fields for client (incoming) connections
request_id	Assigned ID if of the received request.
method	HTTP verb used uppercased, e.g. GET.
target	Request path with parameters, e.g. /path/?delimiter=%2F&prefix=test%2F.

http_server_request_started

New in version v2.3.18.

Emitted when a new HTTP request is received and the request headers (but not body payload) are parsed.

http_server_request_finished

New in version v2.3.18.

Emitted when the HTTP request is fully completed i.e the incoming request body is read and the full response to the request has been sent to the client.

bytes_in	Amount of request data read, in bytes.
bytes_out	Amount of response data written, in bytes.
status_code	HTTP result status code (integer).

IMAP

IMAP client

Field	Description
user	Username of the user
session	Session ID of the IMAP connection
local_ip	IMAP connection’s local (server) IP New in version v2.3.9.
local_port	IMAP connection’s local (server) port New in version v2.3.9.
remote_ip	IMAP connection’s remote (client) IP New in version v2.3.9.
remote_port	IMAP connection’s remote (client) port New in version v2.3.9.

imap_client_hibernated

New in version v2.3.13.

Event emitted when an IMAP client is hibernated or when the hibernation attempt failed.

Field	Description
mailbox	Mailbox name where hibernation was started in.
error	Reason why hibernation attempt failed.

imap_client_unhibernated

New in version v2.3.13.

Event emitted when an IMAP client is hibernated or when the hibernation attempt failed. Note that for failures this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

See also imap process’s imap_client_unhibernated event.

Field	Description
reason	Reason why client was unhibernated: idle_done: IDLE command was stopped with DONE. idle_bad_reply: IDLE command was stopped with some other command than DONE. mailbox_changes: Mailbox change notifications need to be sent to the client.
hibernation_usecs	Number of microseconds how long the client was hibernated.
mailbox	Mailbox name where hibernation was started in.
error	Reason why unhibernation failed.

IMAP command

Field	Description
Inherits from IMAP client
cmd_tag	IMAP command tag New in version v2.3.9.
cmd_name	IMAP command name uppercased (e.g. FETCH). New in version v2.3.9. Changed in version v2.3.11: Contains unknown for unknown command names.
cmd_input_name	IMAP command name exactly as sent (e.g. fetcH) regardless of whether or not it is valid. New in version v2.3.11.
cmd_args	IMAP command’s full parameters (e.g. 1:* FLAGS) New in version v2.3.9.
cmd_human_args	IMAP command’s full parameters, as human-readable output. Often it’s the same as cmd_args, but it is guaranteed to contain only valid UTF-8 characters and no control characters. Multi-line parameters are written only as <N byte multi-line literal> New in version v2.3.9.

imap_command_finished

Event emitted when an IMAP command is completed.

This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.

Note

This event is currently not sent for pre-login IMAP commands.

Field	Description
tagged_reply_state	Values: OK NO BAD
tagged_reply	Full tagged reply (e.g. OK SELECT finished.)
last_run_time	Timestamp when the command was running last time. (Command may be followed by internal “mailbox sync” that can take some time to complete)
running_usecs	How many usecs this command has spent running
lock_wait_usecs	How many usecs this command has spent waiting for locks
bytes_in	Amount of data read, in bytes
bytes_out	Amount of data written, in bytes

IMAP Hibernate

New in version v2.3.13.

Field	Description
user	Username of the user
session	Session ID of the IMAP connection
mailbox	Mailbox name where hibernation was started in.
local_ip	IMAP connection’s local (server) IP
local_port	IMAP connection’s local (server) port
remote_ip	IMAP connection’s remote (client) IP
remote_port	IMAP connection’s remote (client) port

imap_client_unhibernated

Event emitted when an IMAP client is unhibernated or when the unhibernation attempt failed. Note that for failures this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

See also imap process’s imap_client_unhibernated event.

Field	Description
hibernation_usecs	Number of microseconds how long the client was hibernated.
error	Reason why unhibernation failed.

imap_client_unhibernate_retried

Event emitted when an IMAP client is attempted to be unhibernated, but imap processes are busy and the unhibernation attempt is retried. This event is sent each time when retrying is done. The imap_client_unhibernated event is always still sent when unhibernation either succeeds or fails permanently.

Field	Description
error	Reason why unhibernation attempt failed.

Mail Delivery

Events emitted on mail delivery.

Common fields:

Field	Description
Inherits from environment (LDA, LMTP Recipient)
message_id	Message-ID header value (truncated to 200 bytes)
message_subject	Subject header value, in UTF-8 (truncated to 80 bytes)
message_from	Email address in the From header (e.g. user@example.com)
message_size	Size of the message, in bytes
message_vsize	Size of the message with CRLF linefeeds, in bytes
rcpt_to	The envelope recipient for the message

mail_delivery_started

New in version 2.3.8.

Event emitted when message delivery is started.

This event is useful for debugging mail delivery flow.

mail_delivery_finished

New in version 2.3.8.

Event emitted when message delivery is completed.

This event is useful for logging and tracking mail deliveries.

Field	Description
error	Error message if the delivery failed

DNS

Events emitted from Dovecot’s internal DNS client.

dns_worker_request_started

Field	Description
No event specific fields defined

dns_request_started

Field	Description
No event specific fields defined

dns_worker_request_finished

Field	Description
error	Human readable error
error_code	Error code usable with net_gethosterror()

dns_request_finished

Field	Description
error	Human readable error
error_code	Error code usable with net_gethosterror()

SQL

Events emitted by Dovecot’s internal SQL library.

Note

This includes queries sent to Cassandra.

sql_query_finished

Field	Description
error	Human readable error
error_code	Error code (if available)
query_first_word	First word of the query (e.g. SELECT)

sql_transaction_finished

Field	Description
error	Human readable error
error_code	Error code (if available)

sql_connection_finished

Field	Description
No event specific fields defined

SMTP Server

These events are emitted by Dovecot’s internal lib-smtp library.

Connection

Common fields:

Field	Description
Inherits from environment (LDA, LMTP or IMAP)
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. New in version v2.3.18.
protocol	The protocol used by the connection; i.e., either “smtp” or “lmtp”.
session	The session ID for this connection (same as connection_id) New in version v2.3.18.

Command

Common fields:

Field	Description
Inherits from Connection
cmd_name	name of the command New in version v2.3.9.
cmd_input_name	SMTP command name exactly as sent (e.g. MaIL) regardless of whether or not it is valid. New in version v2.3.9.
cmd_args	SMTP command’s full parameters (e.g. <from@example.com>) New in version v2.3.18.
cmd_human_args	SMTP command’s full parameters, as human-readable output. For SMTP, this is currently identical to cmd_args. New in version v2.3.18.

smtp_server_command_started

The command is received from the client.

smtp_server_command_finished

The command is finished. Either a success reply was sent for it or it failed somehow.

Field	Description
status_code	SMTP status code for the (first) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).
enhanced_code	SMTP enhanced status code for the (first) reply. This is “9.0.0” for aborted commands (e.g., when the connection is closed prematurely).
error	Error message for the reply. There is no field for a success message.

Transaction

Common fields:

Field	Description
Normally inherits from Connection
transaction_id	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the “Received:” header). It is based on the connection_id with a “:<seq>” sequence number suffix.
session	Session ID for this transaction (same as transaction_id) New in version v2.3.18.
mail_from	Sender address.
mail_param_auth	The value of the AUTH parameter for the MAIL command.
mail_param_body	The value of the BODY parameter for the MAIL command.
mail_param_envid	The value of the ENVID parameter for the MAIL command.
mail_param_ret	The value of the RET parameter for the MAIL command.
mail_param_size	The value of the SIZE parameter for the MAIL command.
data_size	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.

smtp_server_transaction_started

The transaction is started.

smtp_server_transaction_finished

Transaction is finished or failed.

Field	Description
status_code	SMTP status code for the (first failure) reply. This is = 9000 for aborted transactions (e.g., when the connection is closed prematurely).
enhanced_code	SMTP enhanced status code for the (first failure) reply. This is “9.0.0” for aborted transactions (e.g., when the connection is closed prematurely).
error	Error message for the first failure reply. There is no field for a success message.
recipients	Total number of recipients.
recipients_aborted	The number of recipients that got aborted before these could either finish or fail. This means that the transaction failed early somehow while these recipients were still being processed by the server.
recipients_denied	The number of recipients denied by the server using a negative reply to the RCPT command.
recipients_failed	The number of recipients that failed somehow (includes denied recipients, but not aborted recipients).
recipients_succeeded	The number of recipients for which the transaction finally succeeded.
is_reset	The transaction was reset (RSET) rather than finishing with a DATA/BDAT command as it normally would. This happens when client side issues the RSET command. Note that a reset event is a success (no error field is present).

Recipient

Common fields:

Field	Description
Inherits from Transaction
rcpt_to	Recipient address
rcpt_param_notify	The value of the NOTIFY parameter for the RCPT command.
rcpt_param_orcpt	The address value of the ORCPT parameter for the RCPT command.
rcpt_param_orcpt_type	The address type (typically “rfc822”) of the ORCPT parameter for the RCPT command.
session	Session ID for this transaction and recipient. It is based on the transaction_id with a “:<seq>” recipient sequence number suffix. Only available for LMTP currently.

smtp_server_transaction_rcpt_finished

The transaction is finished or failed for this particular recipient. When successful, this means the DATA command for the transaction yielded success for that recipient (even for SMTP this event is generated for each recipient separately). Recipients can fail at various stages, particularly at the actual RCPT command where the server can deny the recipient.

Field	Description
status_code	SMTP status code for the reply. This is = 9000 for aborted transactions (e.g., when the connection is closed prematurely).
enhanced_code	SMTP enhanced status code for the reply. This is “9.0.0” for aborted transactions (e.g., when the connection is closed prematurely).
error	Error message for the reply if it is a failure. There is no field for a success message.

SMTP Submit

These events are emitted by Dovecot’s internal lib-smtp library when sending mails.

Common fields

Field	Description
Inherits from provided parent event
mail_from	The envelope sender for the outgoing message.
recipients	The number of recipients for the outgoing message.
data_size	The size of the outgoing message.

smtp_submit_started

Started message submission.

smtp_submit_finished

Finished the message submission.

Field	Description
error	Error message for submission failure.

Push notifications

Field	Description
Inherits from Mail user
mailbox	Mailbox for event New in version 2.3.10.

push_notification_finished

Push notification event was sent. See Push notifications

Pigeonhole

Sieve

New in version 2.3.9.

Events emitted by sieve scripts.

Common fields

Field	Description
Inherits from environment (LDA, LMTP or IMAP)
user	Username of the user

Sieve execute

Common fields

Field	Description
Inherits from Sieve
message_id	The message-id of the message being filtered.
mail_from	Envelope sender address if available.
rcpt_to	Envelope recipient address if available.

Sieve runtime

Common fields

Field	Description
Inherits from Sieve execute
script_name	The name of the Sieve script as it is visible to the user.
script_location	The full location string of the Sieve script.
binary_path	The path of the Sieve binary being executed (if it is not only in memory).
error	If present, this field indicates that the script execution has failed. The error message itself is very simple.

sieve_runtime_script_started

Started evaluating a Sieve script.

sieve_runtime_script_finished

Finished evaluating a Sieve script

Sieve action

Field	Description
Inherits from Sieve execute
action_name	The name of the Sieve action.
action_script_location	The location string for this Sieve action (a combination of “<script-name>: line <number>”.
redirect_target	The target address for the redirect action.
notify_target	The list of target addresses for the notify action.
report_target	The target address for the report action.
report_type	The feedback type for the report action.
fileinto_mailbox	The target mailbox for the fileinto/keep action.
pipe_program	The name of the program being executed by the pipe action.

sieve_action_finished

The action was executed successfully. The following actions can occur.

action_name=discard

The discard action was executed successfully (only has an effect when no explicit keep is executed).

action_name=redirect

The redirect action was executed successfully.

action_name=reject

The reject action was executed successfully.

action_name=notify

The notify action was executed successfully (either from the notify or the enotify extension).

action_name=vacation

The vacation action was executed successfully.

action_name=report

The report action (from vnd.dovecot.report extension) was executed successfully.

action_name=fileinto

The fileinto action was executed successfully.

action_name=keep

The keep action was executed successfully (maps to fileinto internally, so the fields are identical).

action_name=pipe

The pipe action (from vnd.dovecot.pipe extension) was executed successfully.

Sieve storage

Events emitted by sieve storage.

Common fields

Field	Description
Inherits from Sieve
storage_driver	The driver name of the Sieve storage (‘file’, ‘ldap’ or ‘dict’)
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.

sieve_script_opened

Opened a Sieve script for reading (e.g. for ManageSieve GETSCRIPT or compiling it at delivery).

sieve_script_closed

Closed a Sieve script (after reading it).

sieve_script_deleted

Deleted a Sieve script.

sieve_script_activated

Activated a Sieve script.

sieve_script_renamed

Renamed a Sieve script.

Field	Description
old_script_name	Old name of the Sieve script
new_script_name	New name for the Sieve script

sieve_storage_save_started

Started saving a Sieve script.

Field	Description
script_name	Name of the Sieve script

sieve_storage_save_finished

Finished saving a Sieve script.

Field	Description
script_name	Name of the Sieve script

Managesieve

Events emitted by the ManageSieve process.

Field	Description
Inherits from client event
cmd_name	Name of the ManageSieve command.
cmd_name	Arguments for the ManageSieve command.
error	Error message for when the command failed.

managesieve_command_finished

Finished the ManageSieve command.

Field	Description
script_name	Name for the Sieve script this command operated on (if any).
old_script_name	Old name of the Sieve script (only set for RENAMESCRIPT).
new_script_name	New name for the Sieve script (only set for RENAMESCRIPT).
compile_errors	The number of compile errors that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when compile fails).
compile_warnings	The number of compile warnings that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when script is compiled).

obox

obox plugin

Index merging

Events emitted by the new index merging (metacache_index_merging=v2).

Field	Description
Inherits from Mailbox
No event specific fields defined

obox_index_merge_started

Mailbox index merging was started.

obox_index_merge_finished

Mailbox index merging was finished.

obox_index_merge_uidvalidity_changed

Index merging required changing the mailbox’s IMAP UIDVALIDITY.

obox_index_merge_uids_renumbered

Index merging required changing some mails’ IMAP UIDs because they conflicted between the two indexes.

Field	Description
renumber_count	Number of UIDs that were renumbered

obox_index_merge_skip_uid_renumbering

Index merging should have renumbered UIDs due to conflicts, but there were too many of them (more than metacache_merge_max_uid_renumbers), so no renumbering was done after all.

Field	Description
renumber_count	Number of UIDs that should have been renumbered

lib-metacache

New in version 2.3.11.

Events emitted by the metacache library.

Field	Description
Inherits from Mail user or Mailbox
No event specific fields defined

metacache_user_refresh_started

metacache_user_refresh_finished

metacache_mailbox_refresh_started

metacache_mailbox_refresh_finished

Metacache is being refreshed when user or mailbox is being accessed. These events are sent only when a storage operation is done to perform the refresh. These events aren’t sent if the metacache is used without refreshing.

Field	Description
metacache_status	Status of the refresh operation: refreshed_changed: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. refreshed_unchanged: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
rescan	yes, if mailbox is going to be rescanned
error	Error message if the refresh failed

metacache_user_bundle_download_started

metacache_user_bundle_download_finished

metacache_mailbox_bundle_download_started

metacache_mailbox_bundle_download_finished

User or mailbox index bundle file is downloaded. These events can happen while the user or mailbox is being refreshed.

Field	Description
filename	Bundle filename
bundle_type	Bundle type: diff, base or self
bundle_size	Size of the bundle file in bytes (uncompressed)
error	Error message if the download failed

metacache_upload_started

metacache_upload_finished

Changes in metacache are being uploaded to storage.

Field	Description
error	Error message if the upload failed

metacache_user_bundle_upload_started

metacache_user_bundle_upload_finished

metacache_mailbox_bundle_upload_started

metacache_mailbox_bundle_upload_finished

User or mailbox index bundle file is uploaded. These events can happen while the user or mailbox is being uploaded. Note that the metacache_user_* events can also be inherited from a mailbox event and include the mailbox fields if the user upload was triggered by a mailbox upload.

Field	Description
filename	Bundle filename
bundle_type	Bundle type: diff, base or self
bundle_size	Size of the bundle file in bytes (uncompressed)
mailbox_guid	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
reason	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
error	Error message if the upload failed

metacache_user_clean_started

metacache_user_clean_finished

Field	Description
min_priority	Which priority indexes are being cleaned
error	Error message if the upload failed

obox_mailbox_rescan_started

obox_mailbox_rescan_finished

obox_mailbox_rebuild_started

obox_mailbox_rebuild_finished

Mailbox is being rescanned or rebuilt. The rescan happens when a mailbox is opened for the first time in this backend (or after it was cleaned away). The rebuild happens after some kind of corruption had been detected. In both cases all the mails in the storage are listed and synced against the local indexes in metacache.

Field	Description
mails_new	Number of new mails found
mails_temp_lost	Number of mails temporarily lost due to “Object exists in dict, but not in storage”.
mails_lost	Number of mails that existed in index, but no longer exists in storage.
mails_lost_during_resync	Number of new mails found, but when doing GUID the mail no longer existed.
mails_kept	Number of mails found in both the index and in storage.
mails_total	Number of mails that exists in the mailbox now.
guid_lookups	Number of mails whose GUIDs were looked up from the email metadata.
guid_lookups_skipped	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
error	Error message if the rescan/rebuild failed

fs-dictmap

fs_dictmap_dict_write_uncertain

New in version 2.3.13.

The event is sent whenever a dict write is uncertain. E.g. writes to Cassandra may eventually succeed even if the write initially appeared to fail.

Field	Description
Inherits from fs_file
path	Virtual FS path to the object (based on dict)
object_id	Object ID in the storage
cleanup	success, failed or disabled. Indicates if uncertain write was attempted to be cleaned (deleted) and whether it was successful. See Dictmap Parameters.
error	Error message why the write initially failed

fs_dictmap_object_lost

New in version 2.3.10.

The event is sent whenever “Object exists in dict, but not in storage” error happens. Normally this shouldn’t happen, because the writes and deletes are done in such an order that Dovecot prefers to rather leak objects in storage than cause this error. A likely source of this error can be resurrected deleted data see Cassandra for more details.

Field	Description
Inherits from fs_file
path	Virtual FS path to the object (based on dict)
object_id	Object ID in the storage
deleted	Set to yes, if the corresponding entry in dict has been deleted as the delete-dangling-links option was set (Dictmap Parameters). New in version 2.3.15.

fs_dictmap_max_bucket_changed

New in version 2.3.13.

This event is sent whenever the max_bucket value for a mailbox changes. There can be three situations when this happens: Either a new mail is added to a mailbox, where the current bucket is found to be filled and the next bucket is started to be filled (reason = file).

Besides the expected situation, Dovecot emits this event if it encounters a bucket with a higher index then the current max_bucket while iterating a mailbox (reason = iter).

Changed in version 2.3.14: In addition max_bucket can be shrunk in case an iteration discovers empty buckets before the current max_bucket value (reason = iter).

The error field is only set if setting the new max_bucket value failed.

Field	Description
Inherits either from fs_file or fs_file
reason	Either file or iter depending on the source of the event as explained above.
old_max_bucket	The max_bucket value for the current mailbox, before the event was emitted.
max_bucket	The newly set max_bucket value.
error	Error string if error occurred.

fs_dictmap_empty_bucket_iterated

New in version 2.3.14.

In case an empty bucket is found while iterating which is not the last bucket emit an event.

Field	Description
Inherits from fs_file
empty_bucket	Index of the empty bucket that was just discovered
max_bucket	The current max_bucket value.
deleted_count	The count of deleted keys for the empty bucket.

Dictionaries

New in version 2.3.11.

Events emitted by dictionary library and dictionary server.

Common fields

Field	Description
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred

dict_created

New in version 2.3.17.

Emitted when a dict is initialized.

Field	Description
dict_name	Name of the dict as set in configurations

dict_destroyed

New in version 2.3.17.

Emitted when a dict is destroyed. Same fields as dict_created.

dict_lookup_finished

Event emitted when lookup finishes.

Field	Description
user	Username, if it’s not empty
key	Key name, starts with priv/ or shared/
key_not_found	Set to yes if key not found

dict_iteration_finished

Field	Description
user	Username, if it’s not empty
key	Used prefix, starts with priv/ or shared/
key_not_found	Set to yes if key not found
rows	Number of rows returned

dict_transaction_finished

Event emitted when transaction has been committed or rolled back.

Field	Description
user	Username, if it’s not empty
rollback	Set to yes when transaction was rolled back
write_uncertain	Set to yes if write was not confirmed

dict_server_lookup_finished

Event emitted when dict server finishes lookup. Same fields as dict_lookup_finished.

dict_server_iteration_finished

Event emitted when dict server finishes iteration. Same fields as dict_iteration_finished.

dict_server_transaction_finished

Event emitted when dict server finishes transaction. Same fields as dict_transaction_finished.

Pre-login Client

Client

Common fields:

Field	Description
local_ip	Local IP address
local_port	Local port
remote_ip	Remote IP address
remote_port	Remote port
user	Full username
service	Name of service e.g. submission, imap

Login proxy

New in version v2.3.18.

Emitted when login process proxies a connection to a backend.

Common fields:

Field	Description
Inherits from Client
dest_host	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as dest_ip).
dest_ip	Proxy destination IP
dest_port	Proxy destination port
source_ip	Source IP where proxy connection originated from
master_user	If proxying is done with a master user authentication, contains the full username of master user.

proxy_session_started

Emitted before connecting to proxy destination.

proxy_session_established

Emitted after proxied connection is established and user is successfully logged in to the backend.

Field	Description
source_port	Source port where proxy connection originated from
reconnect_attempts	Number of times connection failed and reconnection was attempted.

proxy_session_finished

Emitted when proxying has ended. Either successfully or with error.

Field	Description
source_port	Source port where proxy connection originated from.
reconnect_attempts	Number of times connection failed and reconnection was attempted.
error	If login to destination failed, contains the error.
disconnect_side	Which side disconnected: client, server, proxy
disconnect_reason	Reason for disconnection (empty = clean disconnect).
idle_secs	Number of seconds the connection was idling before getting disconnected.
bytes_in	Amount of data read from client, in bytes.
bytes_out	Amount of data written to client, in bytes.

FTS-Dovecot

lib-fts-index

fts_dovecot_too_many_triplets

New in version 2.3.15.

Event emitted when number of triplets exceeds the limit defined by fts_dovecot_max_triplets.

Field	Description
Inherits from Mail user
triplet_count	Number of triplets found