All Dovecot Events
Events
auth_client_passdb_lookup_finished
Authentication client finishes a passdb lookup.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Full username to lookup. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_passdb_lookup_started
Authentication client starts a passdb lookup.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Full username to lookup. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_request_challenged
Authentication client receives a request from server to continue SASL authentication.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if present. |
original_user | Original username, if present. |
auth_user | Auth username, if present. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_request_continued
Authentication client continues SASL authentication by sending a response to server request.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if present. |
original_user | Original username, if present. |
auth_user | Auth username, if present. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_request_finished
Authentication client receives response from server that authentication is finished, either success or failure.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if present. |
original_user | Original username, if present. |
auth_user | Auth username, if present. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_request_started
Authentication client starts authentication request.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if present. |
original_user | Original username, if present. |
auth_user | Auth username, if present. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_userdb_list_finished
Authentication client finishes userdb iteration.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user_mask | User mask to list. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_userdb_list_started
Authentication client starts userdb iteration.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user_mask | User mask to list. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_userdb_lookup_finished
Authentication client finishes a userdb lookup.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Full username to lookup. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_client_userdb_lookup_started
Authentication client starts a userdb lookup.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Full username to lookup. |
error | Error string, if error occurred. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Name of service. Examples: |
transport | Transport security indicator. Values:
|
session | Session identifier. |
certificate_user | Username from certificate. |
client_id | Expands to client ID request as IMAP arglist. Needs |
local_name | TLS SNI. |
local_ip | Local IP client connected to. |
remote_ip | Remote IP of client. |
local_port | Local port client connected to. |
remote_port | Remote port of client. |
real_local_ip | Real local IP as seen by the server. |
real_remote_ip | Real remote IP as seen by the server. |
real_local_port | Real local port as seen by the server. |
real_remote_port | Real remote port as seen by the server. |
tls_cipher | Cipher name used, e.g. |
tls_cipher_bits | Cipher bits, e.g. |
tls_pfs | Perfect forward-security mechanism, e.g. |
tls_protocol | TLS protocol name, e.g. |
auth_master_client_login_finished
Authentication master login request finished.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username of the user. |
error | Error message if the request failed. |
id | Login request ID. |
local_ip | Client connection's local (server) IP. |
local_port | Client connection's local (server) port. |
remote_ip | Client connection's remote (client) IP. |
remote_port | Client connection's remote (client) port. |
auth_master_client_login_started
Authentication master login request started.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
id | Login request ID. |
local_ip | Client connection's local (server) IP. |
local_port | Client connection's local (server) port. |
remote_ip | Client connection's remote (client) IP. |
remote_port | Client connection's remote (client) port. |
auth_passdb_request_finished
Processing has ended for a passdb block.
Most useful for debugging authentication flow.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
result |
|
cache |
|
user | Full username. This can change during authentication, for example due to passdb lookups. |
original_user | Original username exactly as provided by the client. |
translated_user | Similar to |
login_user | When doing a master user login, the user we are logging in as. Otherwise not set. |
master_user | When doing a master user login, the master username. Otherwise not set. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Service doing the lookup (e.g. |
session | Session ID. |
client_id | Expands to client ID request as IMAP arglist. Needs |
remote_ip | Remote IP address of the client connection. |
local_ip | Local IP address where client connected to. |
remote_port | Remote port of the client connection. |
local_port | Local port where the client connected to. |
real_remote_ip | Same as |
real_local_ip | Same as |
real_remote_port | Same as |
real_local_port | Same as |
local_name | TLS SNI hostname, if given. |
transport | Transport security indicator. Values:
|
passdb | Driver name. |
passdb_name |
|
passdb_id | Internal ID number of the passdb. May be useful to identify the passdb if it has no name. |
auth_passdb_request_started
Processing has begun for a passdb block.
Most useful for debugging authentication flow.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Full username. This can change during authentication, for example due to passdb lookups. |
original_user | Original username exactly as provided by the client. |
translated_user | Similar to |
login_user | When doing a master user login, the user we are logging in as. Otherwise not set. |
master_user | When doing a master user login, the master username. Otherwise not set. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Service doing the lookup (e.g. |
session | Session ID. |
client_id | Expands to client ID request as IMAP arglist. Needs |
remote_ip | Remote IP address of the client connection. |
local_ip | Local IP address where client connected to. |
remote_port | Remote port of the client connection. |
local_port | Local port where the client connected to. |
real_remote_ip | Same as |
real_local_ip | Same as |
real_remote_port | Same as |
real_local_port | Same as |
local_name | TLS SNI hostname, if given. |
transport | Transport security indicator. Values:
|
passdb | Driver name. |
passdb_name |
|
passdb_id | Internal ID number of the passdb. May be useful to identify the passdb if it has no name. |
auth_policy_request_finished
Processing has ended for an auth policy request.
Most useful for debugging authentication flow.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mode | Either |
policy_result | Value returned from policy server (number). |
user | Full username. This can change during authentication, for example due to passdb lookups. |
original_user | Original username exactly as provided by the client. |
translated_user | Similar to |
login_user | When doing a master user login, the user we are logging in as. Otherwise not set. |
master_user | When doing a master user login, the master username. Otherwise not set. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Service doing the lookup (e.g. |
session | Session ID. |
client_id | Expands to client ID request as IMAP arglist. Needs |
remote_ip | Remote IP address of the client connection. |
local_ip | Local IP address where client connected to. |
remote_port | Remote port of the client connection. |
local_port | Local port where the client connected to. |
real_remote_ip | Same as |
real_local_ip | Same as |
real_remote_port | Same as |
real_local_port | Same as |
local_name | TLS SNI hostname, if given. |
transport | Transport security indicator. Values:
|
auth_request_finished
Authentication request finished.
Most useful for tracking status of authentication/login attempts.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | Set when error happens. |
success |
|
policy_penalty | Time of penalty added by policy server. |
policy_result |
|
user | Full username. This can change during authentication, for example due to passdb lookups. |
original_user | Original username exactly as provided by the client. |
translated_user | Similar to |
login_user | When doing a master user login, the user we are logging in as. Otherwise not set. |
master_user | When doing a master user login, the master username. Otherwise not set. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Service doing the lookup (e.g. |
session | Session ID. |
client_id | Expands to client ID request as IMAP arglist. Needs |
remote_ip | Remote IP address of the client connection. |
local_ip | Local IP address where client connected to. |
remote_port | Remote port of the client connection. |
local_port | Local port where the client connected to. |
real_remote_ip | Same as |
real_local_ip | Same as |
real_remote_port | Same as |
real_local_port | Same as |
local_name | TLS SNI hostname, if given. |
transport | Transport security indicator. Values:
|
auth_userdb_request_finished
Processing has ended for a userdb block. This event is also sent for userdb iterations.
Most useful for debugging authentication flow.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
result |
|
cache |
|
user | Full username. This can change during authentication, for example due to passdb lookups. |
original_user | Original username exactly as provided by the client. |
translated_user | Similar to |
login_user | When doing a master user login, the user we are logging in as. Otherwise not set. |
master_user | When doing a master user login, the master username. Otherwise not set. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Service doing the lookup (e.g. |
session | Session ID. |
client_id | Expands to client ID request as IMAP arglist. Needs |
remote_ip | Remote IP address of the client connection. |
local_ip | Local IP address where client connected to. |
remote_port | Remote port of the client connection. |
local_port | Local port where the client connected to. |
real_remote_ip | Same as |
real_local_ip | Same as |
real_remote_port | Same as |
real_local_port | Same as |
local_name | TLS SNI hostname, if given. |
transport | Transport security indicator. Values:
|
userdb | Driver name. |
userdb_name |
|
userdb_id | Internal ID number of the userdb. May be useful to identify the userdb if it has no name. |
auth_userdb_request_started
Processing has begun for a userdb block. This event is also sent for userdb iterations.
Most useful for debugging authentication flow.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Full username. This can change during authentication, for example due to passdb lookups. |
original_user | Original username exactly as provided by the client. |
translated_user | Similar to |
login_user | When doing a master user login, the user we are logging in as. Otherwise not set. |
master_user | When doing a master user login, the master username. Otherwise not set. |
mechanism | Name of used SASL mechanism (e.g. PLAIN). |
service | Service doing the lookup (e.g. |
session | Session ID. |
client_id | Expands to client ID request as IMAP arglist. Needs |
remote_ip | Remote IP address of the client connection. |
local_ip | Local IP address where client connected to. |
remote_port | Remote port of the client connection. |
local_port | Local port where the client connected to. |
real_remote_ip | Same as |
real_local_ip | Same as |
real_remote_port | Same as |
real_local_port | Same as |
local_name | TLS SNI hostname, if given. |
transport | Transport security indicator. Values:
|
userdb | Driver name. |
userdb_name |
|
userdb_id | Internal ID number of the userdb. May be useful to identify the userdb if it has no name. |
client_connection_connected
Server accepted an incoming client connection.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
local_ip | Local server IP address where TCP client connected to. |
remote_ip | Remote TCP client's IP address. |
remote_port | Remote TCP client's source port. |
remote_pid | Remote UNIX socket client's process ID. |
remote_uid | Remote UNIX socket client's system user ID. |
client_connection_disconnected
Client connection is terminated.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
net_in_bytes | Amount of data read, in bytes. Changed: 2.4.0 This was previously |
net_out_bytes | Amount of data written, in bytes. Changed: 2.4.0 This was previously |
reason | Disconnection reason. |
local_ip | Local server IP address where TCP client connected to. |
remote_ip | Remote TCP client's IP address. |
remote_port | Remote TCP client's source port. |
remote_pid | Remote UNIX socket client's process ID. |
remote_uid | Remote UNIX socket client's system user ID. |
dict_created
Dictionary is initialized.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
dict_name | Name of the dict as set in configurations. |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dict_destroyed
Dictionary is destroyed.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
dict_name | Name of the dict as set in configurations. |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dict_iteration_finished
Dictionary iteration finished.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
rows | Number of rows returned. |
user | Username, if it's not empty. |
key | Key name, starts with |
key_not_found | Set to |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dict_lookup_finished
Dictionary lookup finishes.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if it's not empty. |
key | Key name, starts with |
key_not_found | Set to |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dict_server_iteration_finished
Dictionary server finishes iteration.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
rows | Number of rows returned. |
user | Username, if it's not empty. |
key | Key name, starts with |
key_not_found | Set to |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dict_server_lookup_finished
Dictionary server finishes lookup.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if it's not empty. |
key | Key name, starts with |
key_not_found | Set to |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dict_server_transaction_finished
Dictionary server finishes transaction.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if it's not empty. |
rollback | Set to |
write_uncertain | Set to |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dict_transaction_finished
Dictionary transaction has been committed or rolled back.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
user | Username, if it's not empty. |
rollback | Set to |
write_uncertain | Set to |
driver | Name of the dictionary driver, e.g. |
error | Error, if one occurred. |
dns_request_finished
DNS request sent by DNS client library to DNS worker process has been finished.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | Human readable error. |
error_code | Error code usable with net_gethosterror(). |
dns_request_started
DNS request sent by DNS client library to DNS worker process.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
dns_worker_request_finished
DNS request finished being processed by DNS worker process.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
cached | Set to Added: 2.4.0 |
error | Human readable error. |
error_code | Error code usable with net_gethosterror(). |
dns_worker_request_started
DNS request started being processed by DNS worker process.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
fs
May be inherited from various different parents (e.g. "Mail User" event) or even from no parent.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
fs_file
Inherits from fs or any other specified event (e.g. mail).
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
fts_flatcurve_expunge
Added: 2.4.0
Emitted when a message is expunged from a mailbox.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | The mailbox name |
uid | The UID that was expunged from FTS index |
fts_flatcurve_index
Added: 2.4.0
Emitted when a message is indexed.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | The mailbox name |
uid | The UID that was added to the FTS index |
fts_flatcurve_last_uid
Added: 2.4.0
Emitted when the system queries for the last UID indexed.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | The mailbox name |
uid | The last UID contained in the FTS index |
fts_flatcurve_optimize
Added: 2.4.0
Emitted when a mailbox is optimized.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | The mailbox name |
fts_flatcurve_query
Added: 2.4.0
Emitted when a query is completed.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
count | The number of messages matched |
mailbox | The mailbox name |
maybe | Are the results uncertain? [yes | no] |
query | The query text sent to Xapian |
uids | The list of UIDs returned by the query |
fts_flatcurve_rescan
Added: 2.4.0
Emitted when a rescan is completed.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
expunged | The list of UIDs that were expunged during rescan |
mailbox | The mailbox name |
status | Status of the rescan [expunge_msgs | missing_msgs | ok] |
uids | The list of UIDs that triggered a non-ok status response |
fts_flatcurve_rotate
Added: 2.4.0
Emitted when a mailbox has its underlying Xapian DB rotated.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | The mailbox name |
http_request_finished
HTTP request is complete.
This event is useful to track and monitor external services.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
attempts | Amount of individual HTTP request attempts (number of retries after failures + 1). |
net_in_bytes | Amount of data read, in bytes. Changed: 2.4.0 This was previously |
net_out_bytes | Amount of data written, in bytes. Changed: 2.4.0 This was previously |
dest_host | Destination host. |
dest_ip | Destination IP address. |
dest_port | Destination port. |
method | HTTP verb used uppercased, e.g. |
redirects | Number of redirects done while processing request. |
status_code | HTTP result status code (integer). |
target | Request path with parameters, e.g. |
http_request_redirected
Intermediate event emitted when an HTTP request is being redirected.
The http_request_finished
is still sent at the end of the request.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
attempts | Amount of individual HTTP request attempts (number of retries after failures + 1). |
net_in_bytes | Amount of data read, in bytes. Changed: 2.4.0 This was previously |
net_out_bytes | Amount of data written, in bytes. Changed: 2.4.0 This was previously |
dest_host | Destination host. |
dest_ip | Destination IP address. |
dest_port | Destination port. |
method | HTTP verb used uppercased, e.g. |
redirects | Number of redirects done while processing request. |
status_code | HTTP result status code (integer). |
target | Request path with parameters, e.g. |
http_request_retried
Intermediate event emitted when an HTTP request is being retried.
The http_request_finished
is still sent at the end of the request.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
attempts | Amount of individual HTTP request attempts (number of retries after failures + 1). |
net_in_bytes | Amount of data read, in bytes. Changed: 2.4.0 This was previously |
net_out_bytes | Amount of data written, in bytes. Changed: 2.4.0 This was previously |
dest_host | Destination host. |
dest_ip | Destination IP address. |
dest_port | Destination port. |
method | HTTP verb used uppercased, e.g. |
redirects | Number of redirects done while processing request. |
status_code | HTTP result status code (integer). |
target | Request path with parameters, e.g. |
http_server_request_finished
HTTP request is fully completed, i.e. the incoming request body is read and the full response to the request has been sent to the client.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
net_in_bytes | Amount of request data read, in bytes. Changed: 2.4.0 This was previously |
net_out_bytes | Amount of response data written, in bytes. Changed: 2.4.0 This was previously |
status_code | HTTP result status code (integer). |
request_id | Assigned ID of the received request. |
method | HTTP verb used uppercased, e.g. |
target | Request path with parameters, e.g. |
local_ip | Local server IP address where TCP client connected to. |
remote_ip | Remote TCP client's IP address. |
remote_port | Remote TCP client's source port. |
remote_pid | Remote UNIX socket client's process ID. |
remote_uid | Remote UNIX socket client's system user ID. |
http_server_request_started
A new HTTP request has been received and the request headers (but not body payload) are parsed.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
request_id | Assigned ID of the received request. |
method | HTTP verb used uppercased, e.g. |
target | Request path with parameters, e.g. |
local_ip | Local server IP address where TCP client connected to. |
remote_ip | Remote TCP client's IP address. |
remote_port | Remote TCP client's source port. |
remote_pid | Remote UNIX socket client's process ID. |
remote_uid | Remote UNIX socket client's system user ID. |
imap_client_hibernated
IMAP client is hibernated or the hibernation attempt failed.
Note
For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | Mailbox name where hibernation was started in. |
error | Reason why hibernation attempt failed. |
user | Username of the user. |
session | Session ID of the IMAP connection. |
local_ip | IMAP connection's local (server) IP. |
local_port | IMAP connection's local (server) port. |
remote_ip | IMAP connection's remote (client) IP. |
remote_port | IMAP connection's remote (client) port. |
imap_client_unhibernate_retried
An IMAP client is attempted to be unhibernated, but imap processes are busy and the unhibernation attempt is retried.
This event is sent each time when retrying is done.
The imap_client_unhibernated
event is still sent when unhibernation
either succeeds or fails permanently.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | Reason why unhibernation failed. |
user | Username of the user. |
session | Session ID of the IMAP connection. |
local_ip | IMAP connection's local (server) IP. |
local_port | IMAP connection's local (server) port. |
remote_ip | IMAP connection's remote (client) IP. |
remote_port | IMAP connection's remote (client) port. |
imap_client_unhibernated
IMAP client is unhibernated or the unhibernation attempt failed.
Note
For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | Mailbox name where hibernation was started in. |
reason | Reason why client was unhibernated:
|
hibernation_usecs | Number of microseconds how long the client was hibernated. |
user | Username of the user. |
session | Session ID of the IMAP connection. |
local_ip | IMAP connection's local (server) IP. |
local_port | IMAP connection's local (server) port. |
remote_ip | IMAP connection's remote (client) IP. |
remote_port | IMAP connection's remote (client) port. |
imap_command_finished
IMAP command is completed.
This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.
Note
This event is currently not sent for pre-login IMAP commands.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
tagged_reply_state | Values:
|
tagged_reply | Full tagged reply (e.g. |
last_run_time | Timestamp when the command was running last time. (Command may be followed by internal "mailbox sync" that can take some time to complete.) |
running_usecs | How many usecs this command has spent running. |
lock_wait_usecs | How many usecs this command has spent waiting for locks. |
net_in_bytes | Amount of data read for this command, in bytes. Changed: 2.4.0 This was previously |
net_out_bytes | Amount of data written for this command, in bytes. Changed: 2.4.0 This was previously |
cmd_tag | IMAP command tag. |
cmd_name | IMAP command name uppercased (e.g. Contains |
cmd_input_name | IMAP command name exactly as sent (e.g. |
cmd_args | IMAP command's full parameters (e.g. |
cmd_human_args | IMAP command's full parameters, as human-readable output. Often it's the
same as Multi-line parameters are written only as |
user | Username of the user. |
session | Session ID of the IMAP connection. |
local_ip | IMAP connection's local (server) IP. |
local_port | IMAP connection's local (server) port. |
remote_ip | IMAP connection's remote (client) IP. |
remote_port | IMAP connection's remote (client) port. |
imap_id_received
Added: 2.4.0
This event is emitted when the IMAP ID command was received, both for pre- as well as post-login. The parameters slightly differ for an unauthenticated client, e.g. there is no user id.Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
id_param_<param> | Received parameters. The event name is the lowercase parameter key prefixed
with |
id_invalid<num> | Each key that contains invalid characters are enumerated starting with 1.
Valid characters are latin alphabetic characters (= |
cmd_tag | IMAP command tag. |
cmd_name | IMAP command name uppercased (e.g. Contains |
cmd_input_name | IMAP command name exactly as sent (e.g. |
cmd_args | IMAP command's full parameters (e.g. |
cmd_human_args | IMAP command's full parameters, as human-readable output. Often it's the
same as Multi-line parameters are written only as |
user | Username of the user. |
session | Session ID of the IMAP connection. |
local_ip | IMAP connection's local (server) IP. |
local_port | IMAP connection's local (server) port. |
remote_ip | IMAP connection's remote (client) IP. |
remote_port | IMAP connection's remote (client) port. |
indexer_worker_indexing_finished
Indexer worker process completed an indexing transaction.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
message_count | Number of messages indexed. |
first_uid | UID of the first indexed message. |
last_uid | UID of the last indexed message. |
user_cpu_usecs | Total user CPU spent on the indexing transaction in microseconds. |
mailbox | Full mailbox name in UTF-8 |
mailbox_guid | Mailbox GUID |
user | Username of the user. |
session | Session ID for the storage session. |
service | Name of the service. Examples: Added: 2.4.0 |
login_aborted
Added: 2.4.0
reason
values:
Reason | Description |
---|---|
anonymous_auth_disabled |
Anonymous authentication is not allowed. |
authorization_failed |
Master user authentication succeeded, but authorization to access the requested login user wasn't allowed. |
auth_aborted_by_client |
Client started SASL authentication, but returned "*" reply to abort it. |
auth_failed |
Generic authentication failure. Possibly due to invalid username/password, but could have been some other unspecified reason also. |
auth_nologin_referral |
Authentication returned auth referral to redirect the client to another server. This is normally configured to be sent only when the client is a Dovecot proxy, which handles the redirection. |
auth_process_comm_fail |
Internal error communicating with the auth process. |
auth_process_not_ready |
Client disconnected before auth process was ready. This may indicate a hanging auth process if connected_usecs is large. |
auth_waiting_client |
Client started SASL authentication, but disconnected instead of sending the next SASL continuation reply. |
cleartext_auth_disabled |
Authentication using cleartext mechanism is not allowed at this point. It would be allowed if SSL/TLS was enabled. |
client_ssl_cert_untrusted |
Client sent an SSL certificate that is untrusted with auth_ssl_require_client_cert = yes . |
client_ssl_cert_missing |
Client didn't send SSL certificate, but auth_ssl_require_client_cert = yes . |
client_ssl_not_started |
Client didn't even start SSL with auth_ssl_require_client_cert = yes . |
connection_limit |
Client reached mail_max_userip_connections limit. |
internal_failure |
Internal failure. The error log has more details. |
invalid_base64 |
Client sent invalid base64 in SASL response. |
invalid_mech |
Unknown SASL authentication mechanism requested. |
login_disabled |
The user has the authentication nologin extra field field set in passdb and is thereby not able to login. |
no_auth_attempts |
Client didn't send any authentication attempts. |
password_expired |
The user's password is expired. |
process_full |
service configuration (client_limit) and service configuration (process_limit) was hit and this login session was killed. |
shutting_down |
The process is shutting down so the login is aborted. |
tls_handshake_not_finished |
TLS handshake failed or was not finished. |
user_disabled |
User is in deny passdb, or in some other way disabled passdb. |
Proxying reason
values:
Reason | Description |
---|---|
proxy_dest_connect_failed |
Local authentication succeeded, but connection to destination hop failed. |
proxy_dest_internal_failure |
Local authentication succeeded, but internal failure occurred after that. |
proxy_dest_remote_failure |
Local authentication succeeded, but destination hop reported unspecified failure. |
proxy_dest_protocol_failure |
Local authentication succeeded, but destination hop unexpectedly violated the protocol standard. |
proxy_dest_auth_failed |
Local authentication succeeded, but proxying failed to authenticate to the destination hop. |
proxy_dest_auth_temp_failed |
Local authentication succeeded, but proxying failed to temporarily authenticate to the destination hop. |
proxy_dest_redirected |
Local authentication succeeded, but destination hop redirected to another host. |
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
reason | Short reason; see the short reason to description mapping. |
auth_successes | Number of successful authentications, which eventually failed due to other reasons. |
auth_attempts | Total number of authentication attempts, both successful and failed. |
auth_usecs | How long ago the first authentication attempt was started. |
connected_usecs | How long ago the client connection was created. |
local_ip | Local IP address. |
local_port | Local port. |
remote_ip | Remote IP address. |
remote_port | Remote port. |
user | Full username. |
service | Name of service e.g. |
mail_cache_corrupted
Cache file was found to be corrupted and the whole file is deleted.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
reason | Reason string why cache was found to be corrupted. |
mail_cache_decision_changed
A field's caching decision changed.
Decisions:
Decision | Description |
---|---|
no |
The field is not cached. |
temp |
The field is cached for 1 week and dropped on the next purge. |
yes |
The field is cached permanently. If the field isn't accessed for 30 days it's dropped. |
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
field | Cache field name (e.g. |
last_used | UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours. |
reason | Reason why the caching decision changed:
|
uid | IMAP UID number that caused the decision change. This is set only for some reasons, not all. |
old_decision | Old cache decision. |
new_decision | New cache decision. |
mail_cache_decision_rejected
The decision to promote a field (from no
to temp
) was rejected.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
field | Cache field name (e.g. |
reason | Reason why the caching decision changed:
|
mail_cache_purge_drop_field
Existing field is dropped from the cache file because it hadn't been accessed for 30 days.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
field | Cache field name (e.g. |
decision | Old caching decision: |
last_used | UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours. |
file_seq | Sequence of the new cache file that is created. |
prev_file_seq | Sequence of the cache file that is to be purged. |
prev_file_size | Size of the cache file that is to be purged. |
prev_deleted_records | Number of records (mails) marked as deleted in the cache file that is to be purged. |
reason | Reason string for purging the cache file:
|
mail_cache_purge_finished
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
file_size | Size of the new cache file. |
max_uid | IMAP UID of the last mail in the cache file. |
file_seq | Sequence of the new cache file that is created. |
prev_file_seq | Sequence of the cache file that is to be purged. |
prev_file_size | Size of the cache file that is to be purged. |
prev_deleted_records | Number of records (mails) marked as deleted in the cache file that is to be purged. |
reason | Reason string for purging the cache file:
|
mail_cache_purge_started
Cache file purging is started.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
file_seq | Sequence of the new cache file that is created. |
prev_file_seq | Sequence of the cache file that is to be purged. |
prev_file_size | Size of the cache file that is to be purged. |
prev_deleted_records | Number of records (mails) marked as deleted in the cache file that is to be purged. |
reason | Reason string for purging the cache file:
|
mail_cache_record_corrupted
Cache record for a specific mail was found to be corrupted and the record is deleted.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
reason | Reason string why cache was found to be corrupted. |
uid | IMAP UID of the mail whose cache record is corrupted. |
mail_delivery_finished
Message delivery is completed.
This event is useful for logging and tracking mail deliveries.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | Error message if the delivery failed. |
message_id | Message-ID header value (truncated to 200 bytes). |
message_subject | Subject header value, in UTF-8 (truncated to 80 bytes). |
message_from | Email address in the From header (e.g. |
message_size | Size of the message, in bytes. |
message_vsize | Size of the message with CRLF linefeeds, in bytes. |
rcpt_to | Recipient address. |
rcpt_param_notify | The value of the NOTIFY parameter for the RCPT command. |
rcpt_param_orcpt | The address value of the ORCPT parameter for the RCPT command. |
rcpt_param_orcpt_type | The address type (typically "rfc822") of the ORCPT parameter for the RCPT command. |
session | The session ID for this connection (same as |
transaction_id | Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix. |
mail_from | Sender address. |
mail_param_auth | The value of the AUTH parameter for the MAIL command. |
mail_param_body | The value of the BODY parameter for the MAIL command. |
mail_param_envid | The value of the ENVID parameter for the MAIL command. |
mail_param_ret | The value of the RET parameter for the MAIL command. |
mail_param_size | The value of the SIZE parameter for the MAIL command. |
data_size | The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command. |
connection_id | The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. |
protocol | The protocol used by the connection; i.e., either |
mail_delivery_started
Message delivery has started.
This event is useful for debugging mail delivery flow.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
message_id | Message-ID header value (truncated to 200 bytes). |
message_subject | Subject header value, in UTF-8 (truncated to 80 bytes). |
message_from | Email address in the From header (e.g. |
message_size | Size of the message, in bytes. |
message_vsize | Size of the message with CRLF linefeeds, in bytes. |
rcpt_to | Recipient address. |
rcpt_param_notify | The value of the NOTIFY parameter for the RCPT command. |
rcpt_param_orcpt | The address value of the ORCPT parameter for the RCPT command. |
rcpt_param_orcpt_type | The address type (typically "rfc822") of the ORCPT parameter for the RCPT command. |
session | The session ID for this connection (same as |
transaction_id | Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix. |
mail_from | Sender address. |
mail_param_auth | The value of the AUTH parameter for the MAIL command. |
mail_param_body | The value of the BODY parameter for the MAIL command. |
mail_param_envid | The value of the ENVID parameter for the MAIL command. |
mail_param_ret | The value of the RET parameter for the MAIL command. |
mail_param_size | The value of the SIZE parameter for the MAIL command. |
data_size | The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command. |
connection_id | The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. |
protocol | The protocol used by the connection; i.e., either |
mail_expunge_requested
A mail is set to be expunged.
Note
Expunges can be rolled back later on, this event is emitted when an expunge is requested.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
seq | Mail sequence number. |
uid | Mail IMAP UID number. |
mailbox | Full mailbox name in UTF-8 |
mailbox_guid | Mailbox GUID |
user | Username of the user. |
session | Session ID for the storage session. |
service | Name of the service. Examples: Added: 2.4.0 |
mail_expunged
A mail was expunged from the mailbox.
Note
This event inherits from mailbox, not mail.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
uid | UID of the expunged mail. |
mailbox | Full mailbox name in UTF-8 |
mailbox_guid | Mailbox GUID |
user | Username of the user. |
session | Session ID for the storage session. |
service | Name of the service. Examples: Added: 2.4.0 |
mail_index_recreated
A mail index file was recreated.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
filepath | Path to the index file being recreated. |
reason | Human-readable reason why the mail index was recreated. |
mail_metadata_accessed
Added: 2.4.0
A mail was opened for reading its metadata.Note
This event is not sent when mails' body is accessed.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
seq | Mail sequence number. |
uid | Mail IMAP UID number. |
mailbox | Full mailbox name in UTF-8 |
mailbox_guid | Mailbox GUID |
user | Username of the user. |
session | Session ID for the storage session. |
service | Name of the service. Examples: Added: 2.4.0 |
mail_opened
A mail was opened, e.g., for reading its body.
Note
This event is not sent when mails' metadata is accessed, even if it causes opening the mail file.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
reason | Reason why the mail was opened. (optional) |
seq | Mail sequence number. |
uid | Mail IMAP UID number. |
mailbox | Full mailbox name in UTF-8 |
mailbox_guid | Mailbox GUID |
user | Username of the user. |
session | Session ID for the storage session. |
service | Name of the service. Examples: Added: 2.4.0 |
mail_user_session_finished
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
utime | User CPU time used in microseconds. |
stime | System CPU time used in microseconds. |
minor_faults | Page reclaims (soft page faults). |
major_faults | Page faults (hard page faults). |
vol_cs | Voluntary context switches. |
invol_cs | Involuntary context switches. |
rss | Resident set size in bytes. (Skipped in non-Linux environments.) |
vsz | Virtual memory size in bytes. (Skipped in non-Linux environments.) |
rchar | I/O counter: chars (bytes) read from storage. (Skipped in non-Linux environments.) |
wchar | I/O counter: chars (bytes) written to storage. (Skipped in non-Linux environments.) |
syscr | Number of read syscalls. (Skipped in non-Linux environments.) |
syscw | Number of write syscalls. (Skipped in non-Linux environments.) |
net_in_bytes | Bytes received during this session (for applicable processes.) Added: 2.4.0 This was previously |
net_out_bytes | Bytes sent during this session (for applicable processes.) Added: 2.4.0 This was previously |
user | Username of the user. |
session | Session ID for the storage session. |
service | Name of the service. Examples: Added: 2.4.0 |
managesieve_command_finished
Finished the ManageSieve command.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
script_name | Name for the Sieve script this command operated on (if any). |
old_script_name | Old name of the Sieve script (only set for RENAMESCRIPT). |
new_script_name | New name for the Sieve script (only set for RENAMESCRIPT). |
compile_errors | The number of compile errors that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when compile fails). |
compile_warnings | The number of compile warnings that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when script is compiled). |
cmd_name | Name of the ManageSieve command. |
cmd_args | Arguments for the ManageSieve command. |
error | Error message for when the command failed. |
pop3_command_finished
Added: 2.4.0
POP3 command is completed.This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.
Note
This event is currently not sent for pre-login POP3 commands.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
reply | POP3 reply. Values:
|
net_in_bytes | Amount of data read for this command, in bytes. |
net_out_bytes | Amount of data written for this command, in bytes. |
cmd_name | POP3 command name uppercased (e.g. |
cmd_args | POP3 command's full parameters (e.g. |
user | Username of the user. |
session | Session ID of the POP3 connection. |
local_ip | POP3 connection's local (server) IP. |
local_port | POP3 connection's local (server) port. |
remote_ip | POP3 connection's remote (client) IP. |
remote_port | POP3 connection's remote (client) port. |
proxy_session_established
Connection to proxy destination is established and user is successfully logged into the backend.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
source_port | Source port where proxy connection originated from. |
reconnect_attempts | Number of times connection failed and reconnection was attempted. |
dest_host | Host name of the proxy destination (if proxying is configured with IP address, will have the same value as |
dest_ip | Proxy destination IP. |
dest_port | Proxy destination port. |
source_ip | Source IP where proxy connection originated from. |
master_user | If proxying is done with a master user authentication, contains the full username of master user. |
local_ip | Local IP address. |
local_port | Local port. |
remote_ip | Remote IP address. |
remote_port | Remote port. |
user | Full username. |
service | Name of service e.g. |
proxy_session_finished
Connection to proxy destination has ended, either successfully or with error.
List of error codes:
Error Code | Explanation |
---|---|
authorization_failed |
User authorization failed. |
temp_fail |
Auth service reported temporary failure. |
user_disabled |
User is disabled. |
password_expired |
Password is expired. |
invalid_base64 |
Challenge response was invalid base64 encoded. |
login_disabled |
Login is disabled. |
invalid_mech |
Used mechanism isn't supported. |
cleartext_auth_disabled |
Cleartext authentication is not enabled, use TLS. |
anonymous_auth_disabled |
Anonymous authentication is not enabled. |
Proxying error codes:
Reason | Description |
---|---|
proxy_dest_connect_failed |
Local authentication succeeded, but connection to destination hop failed. |
proxy_dest_internal_failure |
Local authentication succeeded, but internal failure occurred after that. |
proxy_dest_remote_failure |
Local authentication succeeded, but destination hop reported unspecified failure. |
proxy_dest_protocol_failure |
Local authentication succeeded, but destination hop unexpectedly violated the protocol standard. |
proxy_dest_auth_failed |
Local authentication succeeded, but proxying failed to authenticate to the destination hop. |
proxy_dest_auth_temp_failed |
Local authentication succeeded, but proxying failed to temporarily authenticate to the destination hop. |
proxy_dest_redirected |
Local authentication succeeded, but destination hop redirected to another host. |
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | If login to destination failed, contains the error. |
error_code | If login to destination failed, contains the error code. Added: 2.4.0 |
disconnect_side | Which side disconnected: |
disconnect_reason | Reason for disconnection (empty = clean disconnect). |
idle_usecs | Number of seconds the connection was idling before getting disconnected. Changed: 2.4.0 This was previously named |
net_in_bytes | Amount of data read from client, in bytes. Changed: 2.4.0 This was previously |
net_out_bytes | Amount of data written to client, in bytes. Changed: 2.4.0 This was previously |
source_port | Source port where proxy connection originated from. |
reconnect_attempts | Number of times connection failed and reconnection was attempted. |
dest_host | Host name of the proxy destination (if proxying is configured with IP address, will have the same value as |
dest_ip | Proxy destination IP. |
dest_port | Proxy destination port. |
source_ip | Source IP where proxy connection originated from. |
master_user | If proxying is done with a master user authentication, contains the full username of master user. |
local_ip | Local IP address. |
local_port | Local port. |
remote_ip | Remote IP address. |
remote_port | Remote port. |
user | Full username. |
service | Name of service e.g. |
proxy_session_started
Connection to proxy destination has started.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
dest_host | Host name of the proxy destination (if proxying is configured with IP address, will have the same value as |
dest_ip | Proxy destination IP. |
dest_port | Proxy destination port. |
source_ip | Source IP where proxy connection originated from. |
master_user | If proxying is done with a master user authentication, contains the full username of master user. |
local_ip | Local IP address. |
local_port | Local port. |
remote_ip | Remote IP address. |
remote_port | Remote port. |
user | Full username. |
service | Name of service e.g. |
push_notification_finished
Push notification event was sent. See push notification stats.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
mailbox | Mailbox for event. |
user | Username of the user. |
session | Session ID for the storage session. |
service | Name of the service. Examples: Added: 2.4.0 |
server_connection_connected
Outgoing server connection was either successfully established or failed.
Note
Currently it is not possible to know which one happened.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
source_ip | Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested. |
dest_ip | TCP connection's destination IP address. |
dest_port | TCP connection's destination port. |
dest_host | TCP connection's destination hostname, if known. |
socket_path | UNIX socket connection's path. |
remote_pid | Remote UNIX socket server's process ID. |
remote_uid | Remote UNIX socket server's system user ID. |
server_connection_disconnected
Server connection is terminated.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
reason | Disconnection reason. |
source_ip | Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested. |
dest_ip | TCP connection's destination IP address. |
dest_port | TCP connection's destination port. |
dest_host | TCP connection's destination hostname, if known. |
socket_path | UNIX socket connection's path. |
remote_pid | Remote UNIX socket server's process ID. |
remote_uid | Remote UNIX socket server's system user ID. |
sieve_action_finished
Emitted when sieve action is completed successfully.
Field List
Field | Description | ||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
duration | Duration of the event (in microseconds) | ||||||||||||||||||||
reason_code | List of reason code strings why the event happened. See event reasons for possible values. | ||||||||||||||||||||
action_name |
| ||||||||||||||||||||
action_script_location | The location string for this Sieve action (a combination of "<script-name>: line <number>". | ||||||||||||||||||||
redirect_target | The target address for the redirect action. | ||||||||||||||||||||
notify_target | The list of target addresses for the notify action. | ||||||||||||||||||||
report_target | The target address for the report action. | ||||||||||||||||||||
report_type | The feedback type for the report action. | ||||||||||||||||||||
fileinto_mailbox | The target mailbox for the fileinto/keep action. | ||||||||||||||||||||
pipe_program | The name of the program being executed by the pipe action. | ||||||||||||||||||||
message_id | The message-id of the message being filtered. | ||||||||||||||||||||
mail_from | Envelope sender address if available. | ||||||||||||||||||||
rcpt_to | Envelope recipient address if available. | ||||||||||||||||||||
user | Username of the user. |
sieve_runtime_script_finished
Finished evaluating a Sieve script.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
script_name | The name of the Sieve script as it is visible to the user. |
script_location | The full location string of the Sieve script. |
binary_path | The path of the Sieve binary being executed (if it is not only in memory). |
error | If present, this field indicates that the script execution has failed. The error message itself is very simple. |
message_id | The message-id of the message being filtered. |
mail_from | Envelope sender address if available. |
rcpt_to | Envelope recipient address if available. |
user | Username of the user. |
sieve_runtime_script_started
Started evaluating a Sieve script.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
script_name | The name of the Sieve script as it is visible to the user. |
script_location | The full location string of the Sieve script. |
binary_path | The path of the Sieve binary being executed (if it is not only in memory). |
error | If present, this field indicates that the script execution has failed. The error message itself is very simple. |
message_id | The message-id of the message being filtered. |
mail_from | Envelope sender address if available. |
rcpt_to | Envelope recipient address if available. |
user | Username of the user. |
sieve_script_activated
Activated a Sieve script.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
storage_driver | The driver name of the Sieve storage ( |
script_location | The location string for the Sieve script. |
error | Error message for when storage operation has failed. |
user | Username of the user. |
sieve_script_closed
Closed a Sieve script (after reading it).
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
storage_driver | The driver name of the Sieve storage ( |
script_location | The location string for the Sieve script. |
error | Error message for when storage operation has failed. |
user | Username of the user. |
sieve_script_deleted
Deleted a Sieve script.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
storage_driver | The driver name of the Sieve storage ( |
script_location | The location string for the Sieve script. |
error | Error message for when storage operation has failed. |
user | Username of the user. |
sieve_script_opened
Opened a Sieve script for reading (e.g. for ManageSieve GETSCRIPT or compiling it at delivery).
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
storage_driver | The driver name of the Sieve storage ( |
script_location | The location string for the Sieve script. |
error | Error message for when storage operation has failed. |
user | Username of the user. |
sieve_script_renamed
Renamed a Sieve script.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
old_script_name | Old name of the Sieve script. |
new_script_name | New name for the Sieve script. |
storage_driver | The driver name of the Sieve storage ( |
script_location | The location string for the Sieve script. |
error | Error message for when storage operation has failed. |
user | Username of the user. |
sieve_storage_save_finished
Finished saving a Sieve script.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
script_name | Name of the Sieve script. |
storage_driver | The driver name of the Sieve storage ( |
script_location | The location string for the Sieve script. |
error | Error message for when storage operation has failed. |
user | Username of the user. |
sieve_storage_save_started
Started saving a Sieve script.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
script_name | Name of the Sieve script. |
storage_driver | The driver name of the Sieve storage ( |
script_location | The location string for the Sieve script. |
error | Error message for when storage operation has failed. |
user | Username of the user. |
smtp_server_command_finished
The command is finished. Either a success reply was sent for it or it failed somehow.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
status_code | SMTP status code for the (first) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely). |
enhanced_code | SMTP enhanced status code for the (first) reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely). |
error | Error message for the reply. There is no field for a success message. |
cmd_name | Name of the command. |
cmd_input_name | SMTP command name exactly as sent (e.g. |
cmd_args | SMTP command's full parameters (e.g. |
cmd_human_args | SMTP command's full parameters, as human-readable output. For SMTP, this is currently identical to |
connection_id | The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. |
protocol | The protocol used by the connection; i.e., either |
session | The session ID for this connection (same as |
smtp_server_command_started
The command is received from the client.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
cmd_name | Name of the command. |
cmd_input_name | SMTP command name exactly as sent (e.g. |
cmd_args | SMTP command's full parameters (e.g. |
cmd_human_args | SMTP command's full parameters, as human-readable output. For SMTP, this is currently identical to |
connection_id | The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. |
protocol | The protocol used by the connection; i.e., either |
session | The session ID for this connection (same as |
smtp_server_transaction_finished
Transaction is finished or failed.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
status_code | SMTP status code for the (first failure) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely). |
enhanced_code | SMTP enhanced status code for the (first failure) reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely). |
error | Error message for the first failure reply. There is no field for a success message. |
recipients | Total number of recipients. |
recipients_aborted | The number of recipients that got aborted before these could either finish or fail. This means that the transaction failed early somehow while these recipients were still being processed by the server. |
recipients_denied | The number of recipients denied by the server using a negative reply to the RCPT command. |
recipients_failed | The number of recipients that failed somehow (includes denied recipients, but not aborted recipients). |
recipients_succeeded | The number of recipients for which the transaction finally succeeded. |
is_reset | The transaction was reset (RSET) rather than finishing with a DATA/BDAT command as it normally would. This happens when client side issues the RSET command. Note that a reset event is a success (no error field is present). |
transaction_id | Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix. |
session | The session ID for this connection (same as |
mail_from | Sender address. |
mail_param_auth | The value of the AUTH parameter for the MAIL command. |
mail_param_body | The value of the BODY parameter for the MAIL command. |
mail_param_envid | The value of the ENVID parameter for the MAIL command. |
mail_param_ret | The value of the RET parameter for the MAIL command. |
mail_param_size | The value of the SIZE parameter for the MAIL command. |
data_size | The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command. |
connection_id | The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. |
protocol | The protocol used by the connection; i.e., either |
smtp_server_transaction_rcpt_finished
The transaction is finished or failed for this particular recipient. When successful, this means the DATA command for the transaction yielded success for that recipient (even for SMTP this event is generated for each recipient separately). Recipients can fail at various stages, particularly at the actual RCPT command where the server can deny the recipient.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
status_code | SMTP status code for the reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely). |
enhanced_code | SMTP enhanced status code for the reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely). |
error | Error message for the reply if it is a failure. There is no field for a success message. |
dest_host | LMTP proxying only: Proxy destination hostname. Added: 2.4.0 |
dest_ip | LMTP proxying only: Proxy destination IP address. Added: 2.4.0 |
rcpt_to | Recipient address. |
rcpt_param_notify | The value of the NOTIFY parameter for the RCPT command. |
rcpt_param_orcpt | The address value of the ORCPT parameter for the RCPT command. |
rcpt_param_orcpt_type | The address type (typically "rfc822") of the ORCPT parameter for the RCPT command. |
session | The session ID for this connection (same as |
transaction_id | Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix. |
mail_from | Sender address. |
mail_param_auth | The value of the AUTH parameter for the MAIL command. |
mail_param_body | The value of the BODY parameter for the MAIL command. |
mail_param_envid | The value of the ENVID parameter for the MAIL command. |
mail_param_ret | The value of the RET parameter for the MAIL command. |
mail_param_size | The value of the SIZE parameter for the MAIL command. |
data_size | The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command. |
connection_id | The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. |
protocol | The protocol used by the connection; i.e., either |
smtp_server_transaction_started
The transaction is started.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
transaction_id | Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix. |
session | The session ID for this connection (same as |
mail_from | Sender address. |
mail_param_auth | The value of the AUTH parameter for the MAIL command. |
mail_param_body | The value of the BODY parameter for the MAIL command. |
mail_param_envid | The value of the ENVID parameter for the MAIL command. |
mail_param_ret | The value of the RET parameter for the MAIL command. |
mail_param_size | The value of the SIZE parameter for the MAIL command. |
data_size | The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command. |
connection_id | The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems. |
protocol | The protocol used by the connection; i.e., either |
smtp_submit_finished
Finished the message submission.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | Error message for submission failure. |
mail_from | The envelope sender for the outgoing message. |
recipients | The number of recipients for the outgoing message. |
data_size | The size of the outgoing message. |
smtp_submit_started
Started message submission.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
sql_connection_finished
Connection to SQL server is closed.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
sql_query_finished
Response was received to SQL query.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | Human readable error. |
error_code | Error code (if available). |
query_first_word | First word of the query (e.g. |
consistency | Requested consistency for the query (Cassandra only). Added: 2.4.0 |
error_consistency | Consistency attempted to be used by Cassandra for the failed query (Cassandra only). Added: 2.4.0 |
sql_transaction_finished
SQL transaction was committed or rolled back.
Field List
Field | Description |
---|---|
duration | Duration of the event (in microseconds) |
reason_code | List of reason code strings why the event happened. See event reasons for possible values. |
error | Human readable error. |
error_code | Error code (if available). |
Event Categories
Category | Description | Category Type |
---|---|---|
auth | Authentication (server mainly) | root |
auth-client | Authentication client library | root |
cassandra | Cassandra CQL events | sql |
dict | Dictionary library and drivers | root |
dict-server | Dictionary Dictionary server/proxy (dict process) | root |
dns | DNS client library | root |
dns-worker | DNS client library | root |
fs | FS library | root |
fts | fts plugin | root |
fts-flatcurve | fts-flatcurve plugin | root |
http-client | HTTP client library | root |
http-server | HTTP server library | root |
imap | IMAP process | root |
imap-hibernate | imap-hibernate process | root |
imap-urlauth | imap-urlauth process | root |
imapc | imapc storage | storage |
lda | dovecot-lda process | root |
lmtp | LMTP Server process | root |
local-delivery | LDA/LMTP local delivery | root |
lua | Lua script | root |
mail-cache | dovecot.index.cache file handling | root |
mail-index | dovecot.index* file handling | root |
mailbox | Mailbox (folder) | storage |
maildir | Maildir storage | storage |
managesieve | ManageSieve | root |
mbox | mbox storage | storage |
mdbox | mdbox storage | storage |
mysql | MySQL events | sql |
pgsql | PostgreSQL events | sql |
pop3 | POP3 process | root |
pop3c | pop3c storage | storage |
push-notification | push-notification plugin | root |
quota-status | quota-status process | root |
sdbox | sdbox storage | storage |
service:<name> | Named service, e.g. service:imap or service:auth | root |
sieve | Sieve parent category | sieve |
sieve-action | Individual Sieve actions executed | sieve |
sieve-execute | Sieve script(s) being executed for a particular message; this envelops all of Sieve execution, both runtime and action execution | sieve |
sieve-runtime | Evaluation of individual Sieve scripts | sieve |
sieve-storage | Sieve storage | sieve |
smtp-client | SMTP/LMTP client | root |
smtp-server | SMTP/LMTP server | root |
smtp-submit | SMTP submission client | root |
sql | SQL parent category | sql |
sqlite | SQLite events | sql |
sqlpool | SQL is used internally via "SQL connection pools" | sql |
ssl | SSL/TLS connections | root |
ssl-client | Incoming SSL/TLS connections | root |
ssl-server | Outgoing SSL/TLS connections | root |
storage | Mail storage parent category | storage |
submission | submission server process | root |
Event Reasons
Reason | Description |
---|---|
doveadm:cmd_<name> | Doveadm command is being run. |
fts:index |
Message is being added to the full text search index.
Note that this reason won't be used for email opening events, because the
emails are already opened by the indexer precache searching code. So usually
the indexer:index_mailbox reason is what is wanted to be used. |
fts:lookup | Searching is accessing full text search index. |
imap:cmd_<name> | IMAP command is being run. |
imap:fetch_body |
A part of the message body is explicitly being fetched.
If set, any other imap:fetch_* reasons aren't set since this alone is a
reason for opening the mail. |
imap:fetch_bodystructure | IMAP BODY / BODYSTRUCTURE is being fetched. These should normally come from cache. |
imap:fetch_header |
The full header (except maybe some listed headers) are being fetched.
If set, any other imap:fetch_* reasons aren't set since this alone is a
reason for opening the mail. |
imap:fetch_header_fields | Specific header fields are being fetched. These should normally come from cache. |
imap:fetch_size | RFC822.SIZE is being fetched. This should normally come from cache. |
imap:notify_update | The active NOTIFY command is sending updates to client. |
imap:unhibernate | IMAP client is being unhibernated. |
indexer:index_mailbox | Mailbox is being indexed. |
lazy_expunge:expunge | lazy_expunge plugin is handling an expunge. Use for checking the refcount and for actually doing the lazy_expunge move. |
lmtp:cmd_data | DATA command is being run. |
lmtp:cmd_mail | MAIL command is being run. |
lmtp:cmd_rcpt | RCPT command is being run. |
mail:attachment_keywords |
$HasAttachment or $HasNoAttachment keyword is being generated.
Only emitted when a mail body is opened (not when read from cache). |
mail:date | Date header. Only emitted when a mail body is opened (not when read from cache). |
mail:header_fields | A specified list of headers. These are normally expected to be returned from cache. Only emitted when a mail body is opened (not when read from cache). |
mail:imap_bodystructure | IMAP BODY / BODYSTRUCTURE Only emitted when a mail body is opened (not when read from cache). |
mail:imap_envelope | IMAP ENVELOPE Only emitted when a mail body is opened (not when read from cache). |
mail:mime_parts | MIME part structure. Only emitted when a mail body is opened (not when read from cache). |
mail:snippet | Message snippet / IMAP PREVIEW The other reasons may give further details why. Only emitted when a mail body is opened (not when read from cache). |
mailbox:create | Mailbox is being created |
mailbox:delete | Mailbox is being deleted |
mailbox:rename | Mailbox is being renamed |
mailbox:sort | Mails are being sorted (IMAP SORT) |
mailbox:subscribe | Mailbox is being subscribed |
mailbox:thread | Threading is being built for mails (IMAP THREAD) |
mailbox:unsubscribe | Mailbox is being unsubscribed |
mailbox:update | Mailbox metadata is being updated (e.g. doveadm mailbox update ) |
mailbox:vsize | Mailbox vsize is requested or updated |
mdbox:rebuild | mdbox storage is being rebuilt |
pop3:cmd_<name> | POP3 command is being run. |
pop3:initialize | POP3 mailbox is being opened. |
quota:count |
quota plugin is counting the mailbox's full size.
This is normal with quota=count driver. |
quota:recalculate |
Quota is being recalculated (e.g. doveadm quota recalc ) |
storage:autoexpunge | Mails are being autoexpunged |
storage:mailbox_list_rebuild | Mailbox list index is being rebuilt |
submission:cmd_data | DATA command is being run. |
submission:cmd_mail | MAIL command is being run. |
submission:cmd_rcpt | RCPT command is being run. |
trash:clean | trash plugin cleaning space |
virtual:config_read | virtual plugin mailbox configuration is being read. This may cause mailbox metadata to be accessed. |