All Dovecot Events

Events

auth_client_passdb_lookup_finished

Authentication client finishes a passdb lookup.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Full username to lookup.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_passdb_lookup_started

Authentication client starts a passdb lookup.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Full username to lookup.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_request_challenged

Authentication client receives a request from server to continue SASL authentication.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if present.
original_user	Original username, if present.
auth_user	Auth username, if present.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_request_continued

Authentication client continues SASL authentication by sending a response to server request.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if present.
original_user	Original username, if present.
auth_user	Auth username, if present.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_request_finished

Authentication client receives response from server that authentication is finished, either success or failure.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if present.
original_user	Original username, if present.
auth_user	Auth username, if present.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_request_started

Authentication client starts authentication request.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if present.
original_user	Original username, if present.
auth_user	Auth username, if present.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_userdb_list_finished

Authentication client finishes userdb iteration.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user_mask	User mask to list.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_userdb_list_started

Authentication client starts userdb iteration.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user_mask	User mask to list.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_userdb_lookup_finished

Authentication client finishes a userdb lookup.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Full username to lookup.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_client_userdb_lookup_started

Authentication client starts a userdb lookup.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Full username to lookup.
error	Error string, if error occurred.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Name of service. Examples: imap, pop3, lmtp, ...
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
session	Session identifier.
certificate_user	Username from certificate.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
local_name	TLS SNI.
local_ip	Local IP client connected to.
remote_ip	Remote IP of client.
local_port	Local port client connected to.
remote_port	Remote port of client.
real_local_ip	Real local IP as seen by the server.
real_remote_ip	Real remote IP as seen by the server.
real_local_port	Real local port as seen by the server.
real_remote_port	Real remote port as seen by the server.
tls_cipher	Cipher name used, e.g. TLS_AES_256_GCM_SHA384.
tls_cipher_bits	Cipher bits, e.g. 256.
tls_pfs	Perfect forward-security mechanism, e.g. KxANY, KxECDHE.
tls_protocol	TLS protocol name, e.g. TLSv1.3.

auth_master_client_login_finished

Authentication master login request finished.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username of the user.
error	Error message if the request failed.
id	Login request ID.
local_ip	Client connection's local (server) IP.
local_port	Client connection's local (server) port.
remote_ip	Client connection's remote (client) IP.
remote_port	Client connection's remote (client) port.

auth_master_client_login_started

Authentication master login request started.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
id	Login request ID.
local_ip	Client connection's local (server) IP.
local_port	Client connection's local (server) port.
remote_ip	Client connection's remote (client) IP.
remote_port	Client connection's remote (client) port.

auth_passdb_request_finished

Processing has ended for a passdb block.

Most useful for debugging authentication flow.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
result	ok password_mismatch user_unknown pass_expired user_disabled scheme_not_available internal_failure next
cache	miss: Was not cached hit: Found from cache
user	Full username. This can change during authentication, for example due to passdb lookups.
original_user	Original username exactly as provided by the client.
translated_user	Similar to original_user, except after auth_username_translation translations are applied.
login_user	When doing a master user login, the user we are logging in as. Otherwise not set.
master_user	When doing a master user login, the master username. Otherwise not set.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Service doing the lookup (e.g. imap, pop3, ...).
session	Session ID.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
remote_ip	Remote IP address of the client connection.
local_ip	Local IP address where client connected to.
remote_port	Remote port of the client connection.
local_port	Local port where the client connected to.
real_remote_ip	Same as remote_ip, except if the connection was proxied this is the proxy's IP address.
real_local_ip	Same as local_ip, except if the connection was proxied this is the proxy's IP where proxy connected to.
real_remote_port	Same as remote_port, except if the connection was proxied this is the proxy connection's port.
real_local_port	Same as local_port, except if the connection was proxied this is the local port where the proxy connected to.
local_name	TLS SNI hostname, if given.
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
passdb	Driver name.
passdb_name	passdb { name }, if it is configured. Otherwise, same as passdb { driver }.
passdb_id	Internal ID number of the passdb. May be useful to identify the passdb if it has no name.

auth_passdb_request_started

Processing has begun for a passdb block.

Most useful for debugging authentication flow.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Full username. This can change during authentication, for example due to passdb lookups.
original_user	Original username exactly as provided by the client.
translated_user	Similar to original_user, except after auth_username_translation translations are applied.
login_user	When doing a master user login, the user we are logging in as. Otherwise not set.
master_user	When doing a master user login, the master username. Otherwise not set.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Service doing the lookup (e.g. imap, pop3, ...).
session	Session ID.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
remote_ip	Remote IP address of the client connection.
local_ip	Local IP address where client connected to.
remote_port	Remote port of the client connection.
local_port	Local port where the client connected to.
real_remote_ip	Same as remote_ip, except if the connection was proxied this is the proxy's IP address.
real_local_ip	Same as local_ip, except if the connection was proxied this is the proxy's IP where proxy connected to.
real_remote_port	Same as remote_port, except if the connection was proxied this is the proxy connection's port.
real_local_port	Same as local_port, except if the connection was proxied this is the local port where the proxy connected to.
local_name	TLS SNI hostname, if given.
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
passdb	Driver name.
passdb_name	passdb { name }, if it is configured. Otherwise, same as passdb { driver }.
passdb_id	Internal ID number of the passdb. May be useful to identify the passdb if it has no name.

auth_policy_request_finished

Processing has ended for an auth policy request.

Most useful for debugging authentication flow.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mode	Either allow or report.
policy_result	Value returned from policy server (number).
user	Full username. This can change during authentication, for example due to passdb lookups.
original_user	Original username exactly as provided by the client.
translated_user	Similar to original_user, except after auth_username_translation translations are applied.
login_user	When doing a master user login, the user we are logging in as. Otherwise not set.
master_user	When doing a master user login, the master username. Otherwise not set.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Service doing the lookup (e.g. imap, pop3, ...).
session	Session ID.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
remote_ip	Remote IP address of the client connection.
local_ip	Local IP address where client connected to.
remote_port	Remote port of the client connection.
local_port	Local port where the client connected to.
real_remote_ip	Same as remote_ip, except if the connection was proxied this is the proxy's IP address.
real_local_ip	Same as local_ip, except if the connection was proxied this is the proxy's IP where proxy connected to.
real_remote_port	Same as remote_port, except if the connection was proxied this is the proxy connection's port.
real_local_port	Same as local_port, except if the connection was proxied this is the local port where the proxy connected to.
local_name	TLS SNI hostname, if given.
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS

auth_request_finished

Authentication request finished.

Most useful for tracking status of authentication/login attempts.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	Set when error happens.
success	yes, when authentication succeeded.
policy_penalty	Time of penalty added by policy server.
policy_result	ok, delayed, or refused.
user	Full username. This can change during authentication, for example due to passdb lookups.
original_user	Original username exactly as provided by the client.
translated_user	Similar to original_user, except after auth_username_translation translations are applied.
login_user	When doing a master user login, the user we are logging in as. Otherwise not set.
master_user	When doing a master user login, the master username. Otherwise not set.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Service doing the lookup (e.g. imap, pop3, ...).
session	Session ID.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
remote_ip	Remote IP address of the client connection.
local_ip	Local IP address where client connected to.
remote_port	Remote port of the client connection.
local_port	Local port where the client connected to.
real_remote_ip	Same as remote_ip, except if the connection was proxied this is the proxy's IP address.
real_local_ip	Same as local_ip, except if the connection was proxied this is the proxy's IP where proxy connected to.
real_remote_port	Same as remote_port, except if the connection was proxied this is the proxy connection's port.
real_local_port	Same as local_port, except if the connection was proxied this is the local port where the proxy connected to.
local_name	TLS SNI hostname, if given.
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS

auth_userdb_request_finished

Processing has ended for a userdb block. This event is also sent for userdb iterations.

Most useful for debugging authentication flow.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
result	ok user_unknown internal_failure
cache	miss: Was not cached hit: Found from cache
user	Full username. This can change during authentication, for example due to passdb lookups.
original_user	Original username exactly as provided by the client.
translated_user	Similar to original_user, except after auth_username_translation translations are applied.
login_user	When doing a master user login, the user we are logging in as. Otherwise not set.
master_user	When doing a master user login, the master username. Otherwise not set.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Service doing the lookup (e.g. imap, pop3, ...).
session	Session ID.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
remote_ip	Remote IP address of the client connection.
local_ip	Local IP address where client connected to.
remote_port	Remote port of the client connection.
local_port	Local port where the client connected to.
real_remote_ip	Same as remote_ip, except if the connection was proxied this is the proxy's IP address.
real_local_ip	Same as local_ip, except if the connection was proxied this is the proxy's IP where proxy connected to.
real_remote_port	Same as remote_port, except if the connection was proxied this is the proxy connection's port.
real_local_port	Same as local_port, except if the connection was proxied this is the local port where the proxy connected to.
local_name	TLS SNI hostname, if given.
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
userdb	Driver name.
userdb_name	userdb { name }, if it is configured. Otherwise, same as userdb { driver }.
userdb_id	Internal ID number of the userdb. May be useful to identify the userdb if it has no name.

auth_userdb_request_started

Processing has begun for a userdb block. This event is also sent for userdb iterations.

Most useful for debugging authentication flow.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Full username. This can change during authentication, for example due to passdb lookups.
original_user	Original username exactly as provided by the client.
translated_user	Similar to original_user, except after auth_username_translation translations are applied.
login_user	When doing a master user login, the user we are logging in as. Otherwise not set.
master_user	When doing a master user login, the master username. Otherwise not set.
mechanism	Name of used SASL mechanism (e.g. PLAIN).
service	Service doing the lookup (e.g. imap, pop3, ...).
session	Session ID.
client_id	Expands to client ID request as IMAP arglist. Needs imap_id_retain = yes.
remote_ip	Remote IP address of the client connection.
local_ip	Local IP address where client connected to.
remote_port	Remote port of the client connection.
local_port	Local port where the client connected to.
real_remote_ip	Same as remote_ip, except if the connection was proxied this is the proxy's IP address.
real_local_ip	Same as local_ip, except if the connection was proxied this is the proxy's IP where proxy connected to.
real_remote_port	Same as remote_port, except if the connection was proxied this is the proxy connection's port.
real_local_port	Same as local_port, except if the connection was proxied this is the local port where the proxy connected to.
local_name	TLS SNI hostname, if given.
transport	Transport security indicator. Values: insecure secured Changed: 2.4.0 Secure non-TLS connections (e.g. from localhost) are now secured rather than trusted. TLS
userdb	Driver name.
userdb_name	userdb { name }, if it is configured. Otherwise, same as userdb { driver }.
userdb_id	Internal ID number of the userdb. May be useful to identify the userdb if it has no name.

client_connection_connected

Server accepted an incoming client connection.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
local_ip	Local server IP address where TCP client connected to.
remote_ip	Remote TCP client's IP address.
remote_port	Remote TCP client's source port.
remote_pid	Remote UNIX socket client's process ID.
remote_uid	Remote UNIX socket client's system user ID.

client_connection_disconnected

Client connection is terminated.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
net_in_bytes	Amount of data read, in bytes. Changed: 2.4.0 This was previously in_bytes.
net_out_bytes	Amount of data written, in bytes. Changed: 2.4.0 This was previously out_bytes.
reason	Disconnection reason.
local_ip	Local server IP address where TCP client connected to.
remote_ip	Remote TCP client's IP address.
remote_port	Remote TCP client's source port.
remote_pid	Remote UNIX socket client's process ID.
remote_uid	Remote UNIX socket client's system user ID.

dict_created

Dictionary is initialized.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
dict_name	Name of the dict as set in configurations.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dict_destroyed

Dictionary is destroyed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
dict_name	Name of the dict as set in configurations.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dict_iteration_finished

Dictionary iteration finished.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
rows	Number of rows returned.
user	Username, if it's not empty.
key	Key name, starts with priv/ or shared/.
key_not_found	Set to yes if key not found.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dict_lookup_finished

Dictionary lookup finishes.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if it's not empty.
key	Key name, starts with priv/ or shared/.
key_not_found	Set to yes if key not found.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dict_server_iteration_finished

Dictionary server finishes iteration.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
rows	Number of rows returned.
user	Username, if it's not empty.
key	Key name, starts with priv/ or shared/.
key_not_found	Set to yes if key not found.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dict_server_lookup_finished

Dictionary server finishes lookup.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if it's not empty.
key	Key name, starts with priv/ or shared/.
key_not_found	Set to yes if key not found.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dict_server_transaction_finished

Dictionary server finishes transaction.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if it's not empty.
rollback	Set to yes when transaction was rolled back.
write_uncertain	Set to yes if write was not confirmed.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dict_transaction_finished

Dictionary transaction has been committed or rolled back.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
user	Username, if it's not empty.
rollback	Set to yes when transaction was rolled back.
write_uncertain	Set to yes if write was not confirmed.
driver	Name of the dictionary driver, e.g. sql or proxy.
error	Error, if one occurred.

dns_request_finished

DNS request sent by DNS client library to DNS worker process has been finished.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	Human readable error.
error_code	Error code usable with net_gethosterror().

dns_request_started

DNS request sent by DNS client library to DNS worker process.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.

dns_worker_request_finished

DNS request finished being processed by DNS worker process.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
cached	Set to yes or no depending if it was a cached reply or not. Added: 2.4.0
error	Human readable error.
error_code	Error code usable with net_gethosterror().

dns_worker_request_started

DNS request started being processed by DNS worker process.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.

fs

May be inherited from various different parents (e.g. "Mail User" event) or even from no parent.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.

fs_file

Inherits from fs or any other specified event (e.g. mail).

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.

fts_flatcurve_expunge

Added: 2.4.0

Emitted when a message is expunged from a mailbox.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	The mailbox name
uid	The UID that was expunged from FTS index

fts_flatcurve_index

Added: 2.4.0

Emitted when a message is indexed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	The mailbox name
uid	The UID that was added to the FTS index

fts_flatcurve_last_uid

Added: 2.4.0

Emitted when the system queries for the last UID indexed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	The mailbox name
uid	The last UID contained in the FTS index

fts_flatcurve_optimize

Added: 2.4.0

Emitted when a mailbox is optimized.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	The mailbox name

fts_flatcurve_query

Added: 2.4.0

Emitted when a query is completed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
count	The number of messages matched
mailbox	The mailbox name
maybe	Are the results uncertain? [yes | no]
query	The query text sent to Xapian
uids	The list of UIDs returned by the query

fts_flatcurve_rescan

Added: 2.4.0

Emitted when a rescan is completed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
expunged	The list of UIDs that were expunged during rescan
mailbox	The mailbox name
status	Status of the rescan [expunge_msgs | missing_msgs | ok]
uids	The list of UIDs that triggered a non-ok status response

fts_flatcurve_rotate

Added: 2.4.0

Emitted when a mailbox has its underlying Xapian DB rotated.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	The mailbox name

http_request_finished

HTTP request is complete.

This event is useful to track and monitor external services.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
attempts	Amount of individual HTTP request attempts (number of retries after failures + 1).
net_in_bytes	Amount of data read, in bytes. Changed: 2.4.0 This was previously in_bytes.
net_out_bytes	Amount of data written, in bytes. Changed: 2.4.0 This was previously out_bytes.
dest_host	Destination host.
dest_ip	Destination IP address.
dest_port	Destination port.
method	HTTP verb used uppercased, e.g. GET.
redirects	Number of redirects done while processing request.
status_code	HTTP result status code (integer).
target	Request path with parameters, e.g. /path/?delimiter=%2F&prefix=test%2F.

http_request_redirected

Intermediate event emitted when an HTTP request is being redirected.

The http_request_finished is still sent at the end of the request.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
attempts	Amount of individual HTTP request attempts (number of retries after failures + 1).
net_in_bytes	Amount of data read, in bytes. Changed: 2.4.0 This was previously in_bytes.
net_out_bytes	Amount of data written, in bytes. Changed: 2.4.0 This was previously out_bytes.
dest_host	Destination host.
dest_ip	Destination IP address.
dest_port	Destination port.
method	HTTP verb used uppercased, e.g. GET.
redirects	Number of redirects done while processing request.
status_code	HTTP result status code (integer).
target	Request path with parameters, e.g. /path/?delimiter=%2F&prefix=test%2F.

http_request_retried

Intermediate event emitted when an HTTP request is being retried.

The http_request_finished is still sent at the end of the request.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
attempts	Amount of individual HTTP request attempts (number of retries after failures + 1).
net_in_bytes	Amount of data read, in bytes. Changed: 2.4.0 This was previously in_bytes.
net_out_bytes	Amount of data written, in bytes. Changed: 2.4.0 This was previously out_bytes.
dest_host	Destination host.
dest_ip	Destination IP address.
dest_port	Destination port.
method	HTTP verb used uppercased, e.g. GET.
redirects	Number of redirects done while processing request.
status_code	HTTP result status code (integer).
target	Request path with parameters, e.g. /path/?delimiter=%2F&prefix=test%2F.

http_server_request_finished

HTTP request is fully completed, i.e. the incoming request body is read and the full response to the request has been sent to the client.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
net_in_bytes	Amount of request data read, in bytes. Changed: 2.4.0 This was previously in_bytes.
net_out_bytes	Amount of response data written, in bytes. Changed: 2.4.0 This was previously out_bytes.
status_code	HTTP result status code (integer).
request_id	Assigned ID of the received request.
method	HTTP verb used uppercased, e.g. GET.
target	Request path with parameters, e.g. /path/?delimiter=%2F&prefix=test%2F.
local_ip	Local server IP address where TCP client connected to.
remote_ip	Remote TCP client's IP address.
remote_port	Remote TCP client's source port.
remote_pid	Remote UNIX socket client's process ID.
remote_uid	Remote UNIX socket client's system user ID.

http_server_request_started

A new HTTP request has been received and the request headers (but not body payload) are parsed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
request_id	Assigned ID of the received request.
method	HTTP verb used uppercased, e.g. GET.
target	Request path with parameters, e.g. /path/?delimiter=%2F&prefix=test%2F.
local_ip	Local server IP address where TCP client connected to.
remote_ip	Remote TCP client's IP address.
remote_port	Remote TCP client's source port.
remote_pid	Remote UNIX socket client's process ID.
remote_uid	Remote UNIX socket client's system user ID.

imap_client_hibernated

IMAP client is hibernated or the hibernation attempt failed.

Note

For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	Mailbox name where hibernation was started in.
error	Reason why hibernation attempt failed.
user	Username of the user.
session	Session ID of the IMAP connection.
local_ip	IMAP connection's local (server) IP.
local_port	IMAP connection's local (server) port.
remote_ip	IMAP connection's remote (client) IP.
remote_port	IMAP connection's remote (client) port.

imap_client_unhibernate_retried

An IMAP client is attempted to be unhibernated, but imap processes are busy and the unhibernation attempt is retried.

This event is sent each time when retrying is done.

The imap_client_unhibernated event is still sent when unhibernation either succeeds or fails permanently.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	Reason why unhibernation failed.
user	Username of the user.
session	Session ID of the IMAP connection.
local_ip	IMAP connection's local (server) IP.
local_port	IMAP connection's local (server) port.
remote_ip	IMAP connection's remote (client) IP.
remote_port	IMAP connection's remote (client) port.

imap_client_unhibernated

IMAP client is unhibernated or the unhibernation attempt failed.

Note

For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	Mailbox name where hibernation was started in.
reason	Reason why client was unhibernated: idle_done: IDLE command was stopped with DONE. idle_bad_reply: IDLE command was stopped with some other command than DONE. mailbox_changes: Mailbox change notifications need to be sent to the client.
hibernation_usecs	Number of microseconds how long the client was hibernated.
user	Username of the user.
session	Session ID of the IMAP connection.
local_ip	IMAP connection's local (server) IP.
local_port	IMAP connection's local (server) port.
remote_ip	IMAP connection's remote (client) IP.
remote_port	IMAP connection's remote (client) port.

imap_command_finished

IMAP command is completed.

This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.

Note

This event is currently not sent for pre-login IMAP commands.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
tagged_reply_state	Values: OK NO BAD
tagged_reply	Full tagged reply (e.g. OK SELECT finished.).
last_run_time	Timestamp when the command was running last time. (Command may be followed by internal "mailbox sync" that can take some time to complete.)
running_usecs	How many usecs this command has spent running.
lock_wait_usecs	How many usecs this command has spent waiting for locks.
net_in_bytes	Amount of data read for this command, in bytes. Changed: 2.4.0 This was previously in_bytes.
net_out_bytes	Amount of data written for this command, in bytes. Changed: 2.4.0 This was previously out_bytes.
cmd_tag	IMAP command tag.
cmd_name	IMAP command name uppercased (e.g. FETCH). Contains unknown for unknown command names.
cmd_input_name	IMAP command name exactly as sent (e.g. fetcH) regardless of whether or not it is valid.
cmd_args	IMAP command's full parameters (e.g. 1:* FLAGS).
cmd_human_args	IMAP command's full parameters, as human-readable output. Often it's the same as cmd_args, but it is guaranteed to contain only valid UTF-8 characters and no control characters. Multi-line parameters are written only as <N byte multi-line literal>.
user	Username of the user.
session	Session ID of the IMAP connection.
local_ip	IMAP connection's local (server) IP.
local_port	IMAP connection's local (server) port.
remote_ip	IMAP connection's remote (client) IP.
remote_port	IMAP connection's remote (client) port.

imap_id_received

Added: 2.4.0

This event is emitted when the IMAP ID command was received, both for pre- as well as post-login. The parameters slightly differ for an unauthenticated client, e.g. there is no user id.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
id_param_<param>	Received parameters. The event name is the lowercase parameter key prefixed with id_param_, the value is the parameter value.
id_invalid<num>	Each key that contains invalid characters are enumerated starting with 1. Valid characters are latin alphabetic characters (= a .. z), numerals (= 0 .. 9), the dash (= -) and the underscore (= _), every other character is considered invalid. The value of this field is the original parameter key including invalid characters, followed by a space character, and finally the original value concatenated into a single string.
cmd_tag	IMAP command tag.
cmd_name	IMAP command name uppercased (e.g. FETCH). Contains unknown for unknown command names.
cmd_input_name	IMAP command name exactly as sent (e.g. fetcH) regardless of whether or not it is valid.
cmd_args	IMAP command's full parameters (e.g. 1:* FLAGS).
cmd_human_args	IMAP command's full parameters, as human-readable output. Often it's the same as cmd_args, but it is guaranteed to contain only valid UTF-8 characters and no control characters. Multi-line parameters are written only as <N byte multi-line literal>.
user	Username of the user.
session	Session ID of the IMAP connection.
local_ip	IMAP connection's local (server) IP.
local_port	IMAP connection's local (server) port.
remote_ip	IMAP connection's remote (client) IP.
remote_port	IMAP connection's remote (client) port.

indexer_worker_indexing_finished

Indexer worker process completed an indexing transaction.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
message_count	Number of messages indexed.
first_uid	UID of the first indexed message.
last_uid	UID of the last indexed message.
user_cpu_usecs	Total user CPU spent on the indexing transaction in microseconds.
mailbox	Full mailbox name in UTF-8
mailbox_guid	Mailbox GUID
user	Username of the user.
session	Session ID for the storage session.
service	Name of the service. Examples: imap, pop3, lmtp, ... Added: 2.4.0

login_aborted

Added: 2.4.0

reason values:

Reason	Description
anonymous_auth_disabled	Anonymous authentication is not allowed.
authorization_failed	Master user authentication succeeded, but authorization to access the requested login user wasn't allowed.
auth_aborted_by_client	Client started SASL authentication, but returned "*" reply to abort it.
auth_failed	Generic authentication failure. Possibly due to invalid username/password, but could have been some other unspecified reason also.
auth_nologin_referral	Authentication returned auth referral to redirect the client to another server. This is normally configured to be sent only when the client is a Dovecot proxy, which handles the redirection.
auth_process_comm_fail	Internal error communicating with the auth process.
auth_process_not_ready	Client disconnected before auth process was ready. This may indicate a hanging auth process if connected_usecs is large.
auth_waiting_client	Client started SASL authentication, but disconnected instead of sending the next SASL continuation reply.
cleartext_auth_disabled	Authentication using cleartext mechanism is not allowed at this point. It would be allowed if SSL/TLS was enabled.
client_ssl_cert_untrusted	Client sent an SSL certificate that is untrusted with auth_ssl_require_client_cert = yes.
client_ssl_cert_missing	Client didn't send SSL certificate, but auth_ssl_require_client_cert = yes.
client_ssl_not_started	Client didn't even start SSL with auth_ssl_require_client_cert = yes.
connection_limit	Client reached mail_max_userip_connections limit.
internal_failure	Internal failure. The error log has more details.
invalid_base64	Client sent invalid base64 in SASL response.
invalid_mech	Unknown SASL authentication mechanism requested.
login_disabled	The user has the authentication nologin extra field field set in passdb and is thereby not able to login.
no_auth_attempts	Client didn't send any authentication attempts.
password_expired	The user's password is expired.
process_full	service configuration (client_limit) and service configuration (process_limit) was hit and this login session was killed.
shutting_down	The process is shutting down so the login is aborted.
tls_handshake_not_finished	TLS handshake failed or was not finished.
user_disabled	User is in deny passdb, or in some other way disabled passdb.

Proxying reason values:

Reason	Description
proxy_dest_connect_failed	Local authentication succeeded, but connection to destination hop failed.
proxy_dest_internal_failure	Local authentication succeeded, but internal failure occurred after that.
proxy_dest_remote_failure	Local authentication succeeded, but destination hop reported unspecified failure.
proxy_dest_protocol_failure	Local authentication succeeded, but destination hop unexpectedly violated the protocol standard.
proxy_dest_auth_failed	Local authentication succeeded, but proxying failed to authenticate to the destination hop.
proxy_dest_auth_temp_failed	Local authentication succeeded, but proxying failed to temporarily authenticate to the destination hop.
proxy_dest_redirected	Local authentication succeeded, but destination hop redirected to another host.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
reason	Short reason; see the short reason to description mapping.
auth_successes	Number of successful authentications, which eventually failed due to other reasons.
auth_attempts	Total number of authentication attempts, both successful and failed.
auth_usecs	How long ago the first authentication attempt was started.
connected_usecs	How long ago the client connection was created.
local_ip	Local IP address.
local_port	Local port.
remote_ip	Remote IP address.
remote_port	Remote port.
user	Full username.
service	Name of service e.g. submission, imap.

mail_cache_corrupted

Cache file was found to be corrupted and the whole file is deleted.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
reason	Reason string why cache was found to be corrupted.

mail_cache_decision_changed

A field's caching decision changed.

Decisions:

Decision	Description
no	The field is not cached.
temp	The field is cached for 1 week and dropped on the next purge.
yes	The field is cached permanently. If the field isn't accessed for 30 days it's dropped.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
field	Cache field name (e.g. imap.body or hdr.from).
last_used	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.
reason	Reason why the caching decision changed: add: no -> temp decision change, because a new field was added to cache. old_mail: temp -> yes decision change, because a mail older than 1 week was accessed. unordered_access: temp -> yes decision change, because mails weren't accessed in ascending order. Other values indicate a reason for cache purging, which changes the caching decision yes -> temp.
uid	IMAP UID number that caused the decision change. This is set only for some reasons, not all.
old_decision	Old cache decision.
new_decision	New cache decision.

mail_cache_decision_rejected

The decision to promote a field (from no to temp) was rejected.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
field	Cache field name (e.g. hdr.from).
reason	Reason why the caching decision changed: too_many_headers : This can happen when the count of headers in the cache exceeds the maximum configured with mail_cache_max_headers_count.

mail_cache_purge_drop_field

Existing field is dropped from the cache file because it hadn't been accessed for 30 days.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
field	Cache field name (e.g. imap.body or hdr.from).
decision	Old caching decision: temp, or yes.
last_used	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.
file_seq	Sequence of the new cache file that is created.
prev_file_seq	Sequence of the cache file that is to be purged.
prev_file_size	Size of the cache file that is to be purged.
prev_deleted_records	Number of records (mails) marked as deleted in the cache file that is to be purged.
reason	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index

mail_cache_purge_finished

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
file_size	Size of the new cache file.
max_uid	IMAP UID of the last mail in the cache file.
file_seq	Sequence of the new cache file that is created.
prev_file_seq	Sequence of the cache file that is to be purged.
prev_file_size	Size of the cache file that is to be purged.
prev_deleted_records	Number of records (mails) marked as deleted in the cache file that is to be purged.
reason	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index

mail_cache_purge_started

Cache file purging is started.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
file_seq	Sequence of the new cache file that is created.
prev_file_seq	Sequence of the cache file that is to be purged.
prev_file_size	Size of the cache file that is to be purged.
prev_deleted_records	Number of records (mails) marked as deleted in the cache file that is to be purged.
reason	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index

mail_cache_record_corrupted

Cache record for a specific mail was found to be corrupted and the record is deleted.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
reason	Reason string why cache was found to be corrupted.
uid	IMAP UID of the mail whose cache record is corrupted.

mail_delivery_finished

Message delivery is completed.

This event is useful for logging and tracking mail deliveries.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	Error message if the delivery failed.
message_id	Message-ID header value (truncated to 200 bytes).
message_subject	Subject header value, in UTF-8 (truncated to 80 bytes).
message_from	Email address in the From header (e.g. user@example.com).
message_size	Size of the message, in bytes.
message_vsize	Size of the message with CRLF linefeeds, in bytes.
rcpt_to	Recipient address.
rcpt_param_notify	The value of the NOTIFY parameter for the RCPT command.
rcpt_param_orcpt	The address value of the ORCPT parameter for the RCPT command.
rcpt_param_orcpt_type	The address type (typically "rfc822") of the ORCPT parameter for the RCPT command.
session	The session ID for this connection (same as connection_id).
transaction_id	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
mail_from	Sender address.
mail_param_auth	The value of the AUTH parameter for the MAIL command.
mail_param_body	The value of the BODY parameter for the MAIL command.
mail_param_envid	The value of the ENVID parameter for the MAIL command.
mail_param_ret	The value of the RET parameter for the MAIL command.
mail_param_size	The value of the SIZE parameter for the MAIL command.
data_size	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
protocol	The protocol used by the connection; i.e., either smtp or lmtp.

mail_delivery_started

Message delivery has started.

This event is useful for debugging mail delivery flow.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
message_id	Message-ID header value (truncated to 200 bytes).
message_subject	Subject header value, in UTF-8 (truncated to 80 bytes).
message_from	Email address in the From header (e.g. user@example.com).
message_size	Size of the message, in bytes.
message_vsize	Size of the message with CRLF linefeeds, in bytes.
rcpt_to	Recipient address.
rcpt_param_notify	The value of the NOTIFY parameter for the RCPT command.
rcpt_param_orcpt	The address value of the ORCPT parameter for the RCPT command.
rcpt_param_orcpt_type	The address type (typically "rfc822") of the ORCPT parameter for the RCPT command.
session	The session ID for this connection (same as connection_id).
transaction_id	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
mail_from	Sender address.
mail_param_auth	The value of the AUTH parameter for the MAIL command.
mail_param_body	The value of the BODY parameter for the MAIL command.
mail_param_envid	The value of the ENVID parameter for the MAIL command.
mail_param_ret	The value of the RET parameter for the MAIL command.
mail_param_size	The value of the SIZE parameter for the MAIL command.
data_size	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
protocol	The protocol used by the connection; i.e., either smtp or lmtp.

mail_expunge_requested

A mail is set to be expunged.

Note

Expunges can be rolled back later on, this event is emitted when an expunge is requested.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
seq	Mail sequence number.
uid	Mail IMAP UID number.
mailbox	Full mailbox name in UTF-8
mailbox_guid	Mailbox GUID
user	Username of the user.
session	Session ID for the storage session.
service	Name of the service. Examples: imap, pop3, lmtp, ... Added: 2.4.0

mail_expunged

A mail was expunged from the mailbox.

Note

This event inherits from mailbox, not mail.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
uid	UID of the expunged mail.
mailbox	Full mailbox name in UTF-8
mailbox_guid	Mailbox GUID
user	Username of the user.
session	Session ID for the storage session.
service	Name of the service. Examples: imap, pop3, lmtp, ... Added: 2.4.0

mail_index_recreated

A mail index file was recreated.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
filepath	Path to the index file being recreated.
reason	Human-readable reason why the mail index was recreated.

mail_metadata_accessed

Added: 2.4.0

A mail was opened for reading its metadata.

Note

This event is not sent when mails' body is accessed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
seq	Mail sequence number.
uid	Mail IMAP UID number.
mailbox	Full mailbox name in UTF-8
mailbox_guid	Mailbox GUID
user	Username of the user.
session	Session ID for the storage session.
service	Name of the service. Examples: imap, pop3, lmtp, ... Added: 2.4.0

mail_opened

A mail was opened, e.g., for reading its body.

Note

This event is not sent when mails' metadata is accessed, even if it causes opening the mail file.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
reason	Reason why the mail was opened. (optional)
seq	Mail sequence number.
uid	Mail IMAP UID number.
mailbox	Full mailbox name in UTF-8
mailbox_guid	Mailbox GUID
user	Username of the user.
session	Session ID for the storage session.
service	Name of the service. Examples: imap, pop3, lmtp, ... Added: 2.4.0

mail_user_session_finished

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
utime	User CPU time used in microseconds.
stime	System CPU time used in microseconds.
minor_faults	Page reclaims (soft page faults).
major_faults	Page faults (hard page faults).
vol_cs	Voluntary context switches.
invol_cs	Involuntary context switches.
rss	Resident set size in bytes. (Skipped in non-Linux environments.)
vsz	Virtual memory size in bytes. (Skipped in non-Linux environments.)
rchar	I/O counter: chars (bytes) read from storage. (Skipped in non-Linux environments.)
wchar	I/O counter: chars (bytes) written to storage. (Skipped in non-Linux environments.)
syscr	Number of read syscalls. (Skipped in non-Linux environments.)
syscw	Number of write syscalls. (Skipped in non-Linux environments.)
net_in_bytes	Bytes received during this session (for applicable processes.) Added: 2.4.0 This was previously in_bytes.
net_out_bytes	Bytes sent during this session (for applicable processes.) Added: 2.4.0 This was previously out_bytes.
user	Username of the user.
session	Session ID for the storage session.
service	Name of the service. Examples: imap, pop3, lmtp, ... Added: 2.4.0

managesieve_command_finished

Finished the ManageSieve command.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
script_name	Name for the Sieve script this command operated on (if any).
old_script_name	Old name of the Sieve script (only set for RENAMESCRIPT).
new_script_name	New name for the Sieve script (only set for RENAMESCRIPT).
compile_errors	The number of compile errors that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when compile fails).
compile_warnings	The number of compile warnings that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when script is compiled).
cmd_name	Name of the ManageSieve command.
cmd_args	Arguments for the ManageSieve command.
error	Error message for when the command failed.

pop3_command_finished

Added: 2.4.0

POP3 command is completed.

This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.

Note

This event is currently not sent for pre-login POP3 commands.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
reply	POP3 reply. Values: OK FAIL
net_in_bytes	Amount of data read for this command, in bytes.
net_out_bytes	Amount of data written for this command, in bytes.
cmd_name	POP3 command name uppercased (e.g. UIDL).
cmd_args	POP3 command's full parameters (e.g. 1 1).
user	Username of the user.
session	Session ID of the POP3 connection.
local_ip	POP3 connection's local (server) IP.
local_port	POP3 connection's local (server) port.
remote_ip	POP3 connection's remote (client) IP.
remote_port	POP3 connection's remote (client) port.

proxy_session_established

Connection to proxy destination is established and user is successfully logged into the backend.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
source_port	Source port where proxy connection originated from.
reconnect_attempts	Number of times connection failed and reconnection was attempted.
dest_host	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as dest_ip).
dest_ip	Proxy destination IP.
dest_port	Proxy destination port.
source_ip	Source IP where proxy connection originated from.
master_user	If proxying is done with a master user authentication, contains the full username of master user.
local_ip	Local IP address.
local_port	Local port.
remote_ip	Remote IP address.
remote_port	Remote port.
user	Full username.
service	Name of service e.g. submission, imap.

proxy_session_finished

Connection to proxy destination has ended, either successfully or with error.

List of error codes:

Error Code	Explanation
authorization_failed	User authorization failed.
temp_fail	Auth service reported temporary failure.
user_disabled	User is disabled.
password_expired	Password is expired.
invalid_base64	Challenge response was invalid base64 encoded.
login_disabled	Login is disabled.
invalid_mech	Used mechanism isn't supported.
cleartext_auth_disabled	Cleartext authentication is not enabled, use TLS.
anonymous_auth_disabled	Anonymous authentication is not enabled.

Proxying error codes:

Reason	Description
proxy_dest_connect_failed	Local authentication succeeded, but connection to destination hop failed.
proxy_dest_internal_failure	Local authentication succeeded, but internal failure occurred after that.
proxy_dest_remote_failure	Local authentication succeeded, but destination hop reported unspecified failure.
proxy_dest_protocol_failure	Local authentication succeeded, but destination hop unexpectedly violated the protocol standard.
proxy_dest_auth_failed	Local authentication succeeded, but proxying failed to authenticate to the destination hop.
proxy_dest_auth_temp_failed	Local authentication succeeded, but proxying failed to temporarily authenticate to the destination hop.
proxy_dest_redirected	Local authentication succeeded, but destination hop redirected to another host.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	If login to destination failed, contains the error.
error_code	If login to destination failed, contains the error code. Added: 2.4.0
disconnect_side	Which side disconnected: client, server, proxy.
disconnect_reason	Reason for disconnection (empty = clean disconnect).
idle_usecs	Number of seconds the connection was idling before getting disconnected. Changed: 2.4.0 This was previously named idle_secs.
net_in_bytes	Amount of data read from client, in bytes. Changed: 2.4.0 This was previously in_bytes.
net_out_bytes	Amount of data written to client, in bytes. Changed: 2.4.0 This was previously out_bytes.
source_port	Source port where proxy connection originated from.
reconnect_attempts	Number of times connection failed and reconnection was attempted.
dest_host	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as dest_ip).
dest_ip	Proxy destination IP.
dest_port	Proxy destination port.
source_ip	Source IP where proxy connection originated from.
master_user	If proxying is done with a master user authentication, contains the full username of master user.
local_ip	Local IP address.
local_port	Local port.
remote_ip	Remote IP address.
remote_port	Remote port.
user	Full username.
service	Name of service e.g. submission, imap.

proxy_session_started

Connection to proxy destination has started.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
dest_host	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as dest_ip).
dest_ip	Proxy destination IP.
dest_port	Proxy destination port.
source_ip	Source IP where proxy connection originated from.
master_user	If proxying is done with a master user authentication, contains the full username of master user.
local_ip	Local IP address.
local_port	Local port.
remote_ip	Remote IP address.
remote_port	Remote port.
user	Full username.
service	Name of service e.g. submission, imap.

push_notification_finished

Push notification event was sent. See push notification stats.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
mailbox	Mailbox for event.
user	Username of the user.
session	Session ID for the storage session.
service	Name of the service. Examples: imap, pop3, lmtp, ... Added: 2.4.0

server_connection_connected

Outgoing server connection was either successfully established or failed.

Note

Currently it is not possible to know which one happened.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
source_ip	Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested.
dest_ip	TCP connection's destination IP address.
dest_port	TCP connection's destination port.
dest_host	TCP connection's destination hostname, if known.
socket_path	UNIX socket connection's path.
remote_pid	Remote UNIX socket server's process ID.
remote_uid	Remote UNIX socket server's system user ID.

server_connection_disconnected

Server connection is terminated.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
reason	Disconnection reason.
source_ip	Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested.
dest_ip	TCP connection's destination IP address.
dest_port	TCP connection's destination port.
dest_host	TCP connection's destination hostname, if known.
socket_path	UNIX socket connection's path.
remote_pid	Remote UNIX socket server's process ID.
remote_uid	Remote UNIX socket server's system user ID.

sieve_action_finished

Emitted when sieve action is completed successfully.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
action_name	Action Description discard The discard action was executed successfully (only has an effect when no explicit keep is executed). ileinto` The fileinto action was executed successfully. keep The keep action was executed successfully (maps to fileinto internally, so the fields are identical). notify The notify action was executed successfully (either from the notify or the enotify extension). pipe The pipe action (from vnd.dovecot.pipe extension) was executed successfully. redirect The redirect action was executed successfully. reject The reject action was executed successfully. report The report action (from vnd.dovecot.report extension) was executed successfully. vacation The vacation action was executed successfully.
action_script_location	The location string for this Sieve action (a combination of "<script-name>: line <number>".
redirect_target	The target address for the redirect action.
notify_target	The list of target addresses for the notify action.
report_target	The target address for the report action.
report_type	The feedback type for the report action.
fileinto_mailbox	The target mailbox for the fileinto/keep action.
pipe_program	The name of the program being executed by the pipe action.
message_id	The message-id of the message being filtered.
mail_from	Envelope sender address if available.
rcpt_to	Envelope recipient address if available.
user	Username of the user.

sieve_runtime_script_finished

Finished evaluating a Sieve script.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
script_name	The name of the Sieve script as it is visible to the user.
script_location	The full location string of the Sieve script.
binary_path	The path of the Sieve binary being executed (if it is not only in memory).
error	If present, this field indicates that the script execution has failed. The error message itself is very simple.
message_id	The message-id of the message being filtered.
mail_from	Envelope sender address if available.
rcpt_to	Envelope recipient address if available.
user	Username of the user.

sieve_runtime_script_started

Started evaluating a Sieve script.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
script_name	The name of the Sieve script as it is visible to the user.
script_location	The full location string of the Sieve script.
binary_path	The path of the Sieve binary being executed (if it is not only in memory).
error	If present, this field indicates that the script execution has failed. The error message itself is very simple.
message_id	The message-id of the message being filtered.
mail_from	Envelope sender address if available.
rcpt_to	Envelope recipient address if available.
user	Username of the user.

sieve_script_activated

Activated a Sieve script.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
storage_driver	The driver name of the Sieve storage (file, ldap, or dict).
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.
user	Username of the user.

sieve_script_closed

Closed a Sieve script (after reading it).

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
storage_driver	The driver name of the Sieve storage (file, ldap, or dict).
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.
user	Username of the user.

sieve_script_deleted

Deleted a Sieve script.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
storage_driver	The driver name of the Sieve storage (file, ldap, or dict).
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.
user	Username of the user.

sieve_script_opened

Opened a Sieve script for reading (e.g. for ManageSieve GETSCRIPT or compiling it at delivery).

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
storage_driver	The driver name of the Sieve storage (file, ldap, or dict).
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.
user	Username of the user.

sieve_script_renamed

Renamed a Sieve script.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
old_script_name	Old name of the Sieve script.
new_script_name	New name for the Sieve script.
storage_driver	The driver name of the Sieve storage (file, ldap, or dict).
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.
user	Username of the user.

sieve_storage_save_finished

Finished saving a Sieve script.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
script_name	Name of the Sieve script.
storage_driver	The driver name of the Sieve storage (file, ldap, or dict).
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.
user	Username of the user.

sieve_storage_save_started

Started saving a Sieve script.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
script_name	Name of the Sieve script.
storage_driver	The driver name of the Sieve storage (file, ldap, or dict).
script_location	The location string for the Sieve script.
error	Error message for when storage operation has failed.
user	Username of the user.

smtp_server_command_finished

The command is finished. Either a success reply was sent for it or it failed somehow.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
status_code	SMTP status code for the (first) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).
enhanced_code	SMTP enhanced status code for the (first) reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely).
error	Error message for the reply. There is no field for a success message.
cmd_name	Name of the command.
cmd_input_name	SMTP command name exactly as sent (e.g. MaIL) regardless of whether or not it is valid.
cmd_args	SMTP command's full parameters (e.g. <from@example.com>).
cmd_human_args	SMTP command's full parameters, as human-readable output. For SMTP, this is currently identical to cmd_args.
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
protocol	The protocol used by the connection; i.e., either smtp or lmtp.
session	The session ID for this connection (same as connection_id).

smtp_server_command_started

The command is received from the client.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
cmd_name	Name of the command.
cmd_input_name	SMTP command name exactly as sent (e.g. MaIL) regardless of whether or not it is valid.
cmd_args	SMTP command's full parameters (e.g. <from@example.com>).
cmd_human_args	SMTP command's full parameters, as human-readable output. For SMTP, this is currently identical to cmd_args.
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
protocol	The protocol used by the connection; i.e., either smtp or lmtp.
session	The session ID for this connection (same as connection_id).

smtp_server_transaction_finished

Transaction is finished or failed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
status_code	SMTP status code for the (first failure) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).
enhanced_code	SMTP enhanced status code for the (first failure) reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely).
error	Error message for the first failure reply. There is no field for a success message.
recipients	Total number of recipients.
recipients_aborted	The number of recipients that got aborted before these could either finish or fail. This means that the transaction failed early somehow while these recipients were still being processed by the server.
recipients_denied	The number of recipients denied by the server using a negative reply to the RCPT command.
recipients_failed	The number of recipients that failed somehow (includes denied recipients, but not aborted recipients).
recipients_succeeded	The number of recipients for which the transaction finally succeeded.
is_reset	The transaction was reset (RSET) rather than finishing with a DATA/BDAT command as it normally would. This happens when client side issues the RSET command. Note that a reset event is a success (no error field is present).
transaction_id	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
session	The session ID for this connection (same as connection_id).
mail_from	Sender address.
mail_param_auth	The value of the AUTH parameter for the MAIL command.
mail_param_body	The value of the BODY parameter for the MAIL command.
mail_param_envid	The value of the ENVID parameter for the MAIL command.
mail_param_ret	The value of the RET parameter for the MAIL command.
mail_param_size	The value of the SIZE parameter for the MAIL command.
data_size	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
protocol	The protocol used by the connection; i.e., either smtp or lmtp.

smtp_server_transaction_rcpt_finished

The transaction is finished or failed for this particular recipient. When successful, this means the DATA command for the transaction yielded success for that recipient (even for SMTP this event is generated for each recipient separately). Recipients can fail at various stages, particularly at the actual RCPT command where the server can deny the recipient.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
status_code	SMTP status code for the reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).
enhanced_code	SMTP enhanced status code for the reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely).
error	Error message for the reply if it is a failure. There is no field for a success message.
dest_host	LMTP proxying only: Proxy destination hostname. Added: 2.4.0
dest_ip	LMTP proxying only: Proxy destination IP address. Added: 2.4.0
rcpt_to	Recipient address.
rcpt_param_notify	The value of the NOTIFY parameter for the RCPT command.
rcpt_param_orcpt	The address value of the ORCPT parameter for the RCPT command.
rcpt_param_orcpt_type	The address type (typically "rfc822") of the ORCPT parameter for the RCPT command.
session	The session ID for this connection (same as connection_id).
transaction_id	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
mail_from	Sender address.
mail_param_auth	The value of the AUTH parameter for the MAIL command.
mail_param_body	The value of the BODY parameter for the MAIL command.
mail_param_envid	The value of the ENVID parameter for the MAIL command.
mail_param_ret	The value of the RET parameter for the MAIL command.
mail_param_size	The value of the SIZE parameter for the MAIL command.
data_size	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
protocol	The protocol used by the connection; i.e., either smtp or lmtp.

smtp_server_transaction_started

The transaction is started.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
transaction_id	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
session	The session ID for this connection (same as connection_id).
mail_from	Sender address.
mail_param_auth	The value of the AUTH parameter for the MAIL command.
mail_param_body	The value of the BODY parameter for the MAIL command.
mail_param_envid	The value of the ENVID parameter for the MAIL command.
mail_param_ret	The value of the RET parameter for the MAIL command.
mail_param_size	The value of the SIZE parameter for the MAIL command.
data_size	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
connection_id	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
protocol	The protocol used by the connection; i.e., either smtp or lmtp.

smtp_submit_finished

Finished the message submission.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	Error message for submission failure.
mail_from	The envelope sender for the outgoing message.
recipients	The number of recipients for the outgoing message.
data_size	The size of the outgoing message.

smtp_submit_started

Started message submission.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.

sql_connection_finished

Connection to SQL server is closed.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.

sql_query_finished

Response was received to SQL query.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	Human readable error.
error_code	Error code (if available).
query_first_word	First word of the query (e.g. SELECT).
consistency	Requested consistency for the query (Cassandra only). Added: 2.4.0
error_consistency	Consistency attempted to be used by Cassandra for the failed query (Cassandra only). Added: 2.4.0

sql_transaction_finished

SQL transaction was committed or rolled back.

Field	Description
duration	Duration of the event (in microseconds)
reason_code	List of reason code strings why the event happened. See event reasons for possible values.
error	Human readable error.
error_code	Error code (if available).

Event Categories

Category	Description	Category Type
auth	Authentication (server mainly)	root
auth-client	Authentication client library	root
cassandra	Cassandra CQL events	sql
dict	Dictionary library and drivers	root
dict-server	Dictionary Dictionary server/proxy (dict process)	root
dns	DNS client library	root
dns-worker	DNS client library	root
fs	FS library	root
fts	fts plugin	root
fts-flatcurve	fts-flatcurve plugin	root
http-client	HTTP client library	root
http-server	HTTP server library	root
imap	IMAP process	root
imap-hibernate	imap-hibernate process	root
imap-urlauth	imap-urlauth process	root
imapc	imapc storage	storage
lda	dovecot-lda process	root
lmtp	LMTP Server process	root
local-delivery	LDA/LMTP local delivery	root
lua	Lua script	root
mail-cache	dovecot.index.cache file handling	root
mail-index	dovecot.index* file handling	root
mailbox	Mailbox (folder)	storage
maildir	Maildir storage	storage
managesieve	ManageSieve	root
mbox	mbox storage	storage
mdbox	mdbox storage	storage
mysql	MySQL events	sql
pgsql	PostgreSQL events	sql
pop3	POP3 process	root
pop3c	pop3c storage	storage
push-notification	push-notification plugin	root
quota-status	quota-status process	root
sdbox	sdbox storage	storage
service:<name>	Named service, e.g. service:imap or service:auth	root
sieve	Sieve parent category	sieve
sieve-action	Individual Sieve actions executed	sieve
sieve-execute	Sieve script(s) being executed for a particular message; this envelops all of Sieve execution, both runtime and action execution	sieve
sieve-runtime	Evaluation of individual Sieve scripts	sieve
sieve-storage	Sieve storage	sieve
smtp-client	SMTP/LMTP client	root
smtp-server	SMTP/LMTP server	root
smtp-submit	SMTP submission client	root
sql	SQL parent category	sql
sqlite	SQLite events	sql
sqlpool	SQL is used internally via "SQL connection pools"	sql
ssl	SSL/TLS connections	root
ssl-client	Incoming SSL/TLS connections	root
ssl-server	Outgoing SSL/TLS connections	root
storage	Mail storage parent category	storage
submission	submission server process	root

Event Reasons

Reason	Description
doveadm:cmd_<name>	Doveadm command is being run.
fts:index	Message is being added to the full text search index. Note that this reason won't be used for email opening events, because the emails are already opened by the indexer precache searching code. So usually the indexer:index_mailbox reason is what is wanted to be used.
fts:lookup	Searching is accessing full text search index.
imap:cmd_<name>	IMAP command is being run.
imap:fetch_body	A part of the message body is explicitly being fetched. If set, any other imap:fetch_* reasons aren't set since this alone is a reason for opening the mail.
imap:fetch_bodystructure	IMAP BODY / BODYSTRUCTURE is being fetched. These should normally come from cache.
imap:fetch_header	The full header (except maybe some listed headers) are being fetched. If set, any other imap:fetch_* reasons aren't set since this alone is a reason for opening the mail.
imap:fetch_header_fields	Specific header fields are being fetched. These should normally come from cache.
imap:fetch_size	RFC822.SIZE is being fetched. This should normally come from cache.
imap:notify_update	The active NOTIFY command is sending updates to client.
imap:unhibernate	IMAP client is being unhibernated.
indexer:index_mailbox	Mailbox is being indexed.
lazy_expunge:expunge	lazy_expunge plugin is handling an expunge. Use for checking the refcount and for actually doing the lazy_expunge move.
lmtp:cmd_data	DATA command is being run.
lmtp:cmd_mail	MAIL command is being run.
lmtp:cmd_rcpt	RCPT command is being run.
mail:attachment_keywords	$HasAttachment or $HasNoAttachment keyword is being generated. Only emitted when a mail body is opened (not when read from cache).
mail:date	Date header. Only emitted when a mail body is opened (not when read from cache).
mail:header_fields	A specified list of headers. These are normally expected to be returned from cache. Only emitted when a mail body is opened (not when read from cache).
mail:imap_bodystructure	IMAP BODY / BODYSTRUCTURE Only emitted when a mail body is opened (not when read from cache).
mail:imap_envelope	IMAP ENVELOPE Only emitted when a mail body is opened (not when read from cache).
mail:mime_parts	MIME part structure. Only emitted when a mail body is opened (not when read from cache).
mail:snippet	Message snippet / IMAP PREVIEW The other reasons may give further details why. Only emitted when a mail body is opened (not when read from cache).
mailbox:create	Mailbox is being created
mailbox:delete	Mailbox is being deleted
mailbox:rename	Mailbox is being renamed
mailbox:sort	Mails are being sorted (IMAP SORT)
mailbox:subscribe	Mailbox is being subscribed
mailbox:thread	Threading is being built for mails (IMAP THREAD)
mailbox:unsubscribe	Mailbox is being unsubscribed
mailbox:update	Mailbox metadata is being updated (e.g. doveadm mailbox update)
mailbox:vsize	Mailbox vsize is requested or updated
mdbox:rebuild	mdbox storage is being rebuilt
pop3:cmd_<name>	POP3 command is being run.
pop3:initialize	POP3 mailbox is being opened.
quota:count	quota plugin is counting the mailbox's full size. This is normal with quota=count driver.
quota:recalculate	Quota is being recalculated (e.g. doveadm quota recalc)
storage:autoexpunge	Mails are being autoexpunged
storage:mailbox_list_rebuild	Mailbox list index is being rebuilt
submission:cmd_data	DATA command is being run.
submission:cmd_mail	MAIL command is being run.
submission:cmd_rcpt	RCPT command is being run.
trash:clean	trash plugin cleaning space
virtual:config_read	virtual plugin mailbox configuration is being read. This may cause mailbox metadata to be accessed.