← Back
Editing: Debugging.Rawlog.txt
Rawlog ====== Dovecot supports logging IMAP/POP3/LMTP/SMTP(submission) traffic (also TLS/SSL encrypted). There are several possibilities for this: 1. rawlog_dir setting (v2.2.26+) 2. Using 'rawlog' binary, which is executed as post-login script. 3. Pre-login imap/pop3-login process via -R parameter. 4. For <lmtp> [LMTP.txt], you need to use lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings (since v2.3.2) 5. For <submission> [Submission.txt], you can use rawlog_dir setting and submission_relay_rawlog_dir (since v2.3.2) rawlog_dir setting (v2.2.26+) ----------------------------- Dovecot creates *.in and *.out rawlogs to the specified directory if it exists. For example: ---%<------------------------------------------------------------------------- protocol imap { rawlog_dir = /tmp/rawlog/%u # if you want to put files into user's homedir, use this, do not use ~ #rawlog_dir = %h/rawlog } ---%<------------------------------------------------------------------------- lmtp_rawlog_dir (v2.3.2+) ------------------------- You can use lmtp_rawlog_dir to generate rawlogs on lmtp backend server. Unlike the rawlog_dir setting, this does not accept variables. lmtp_proxy_rawlog_dir (v2.3.2+) ------------------------------- You can use lmtp_proxy_rawlog_dir to generate rawlogs on lmtp proxy server. Unlike the rawlog_dir setting, this does not accept variables. submission_relay_rawlog_dir (v2.3.2+) ------------------------------------- You can use submission_relay_rawlog_dir to generate relay rawlogs on the dovecot submission server. rawlog binary ------------- It works by checking if 'dovecot.rawlog/' directory exists in the logged in user's home directory, and writing the traffic to 'yyyymmdd-HHMMSS-pid.in' and '.out' files. Each connection gets their own in/out files. Rawlog will simply skip users who don't have the 'dovecot.rawlog/' directory and the performance impact for those users is minimal. Home directory -------------- Note that for rawlog to work, your <userdb> [UserDatabase.txt] must have returned a home directory for the user.*IMPORTANT: The home directory must be returned by userdb, mail_home setting won't work.* Verify that 'doveadm user -u user@example.com' (with -u parameter) returns the home directory, for example: ---%<------------------------------------------------------------------------- % doveadm user -u user@example.com userdb: user@example.com user : user@example.com uid : 1000 gid : 1000 home : /home/user@example.com ---%<------------------------------------------------------------------------- In above configuration rawlog would expect to find '/home/user@example.com/dovecot.rawlog/' directory writable by uid 1000. If your userdb can't return a home directory directly, with v2.1+ you can add: ---%<------------------------------------------------------------------------- userdb { # ... default_fields = home=/home/%u # or temporarily even e.g. default_fields = home=/tmp/temp-home } ---%<------------------------------------------------------------------------- You can also set DEBUG environment to have rawlog log an info message why it's not doing anything: ---%<------------------------------------------------------------------------- import_environment = $import_environment DEBUG=1 ---%<------------------------------------------------------------------------- Configuration ------------- To enable rawlog, you must use rawlog as a <post-login script> [PostLoginScripting.txt]: ---%<------------------------------------------------------------------------- service imap { executable = imap postlogin } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } ---%<------------------------------------------------------------------------- You can also give parameters to rawlog: * -b: Write IP packet boundaries (or whatever read() sees anyway) to the log files. The packet is written between<<< and >>>. * -t: Log a microsecond resolution timestamp at the beginning of each line. * -I: Include IP address in the filename (v2.2.16+) * v2.1 and newer: * -f in: Log only to *.in files * -f out: Log only to *.out files * v2.0 and older: * -i: Log only to *.in files * -o: Log only to *.out files Pre-login rawlog (v2.1+) ------------------------ You can enable pre-login rawlog for all users by telling the login processes to log to a rawlog directory, for example: ---%<------------------------------------------------------------------------- service imap-login { executable = imap-login -R rawlogs } ---%<------------------------------------------------------------------------- This tries to write the rawlogs under $base_dir/login/rawlogs directory. You need to create it first with enough write permissions, e.g.: ---%<------------------------------------------------------------------------- mkdir /var/run/dovecot/login/rawlogs chown dovenull /var/run/dovecot/login/rawlogs chmod 0700 /var/run/dovecot/login/rawlogs ---%<------------------------------------------------------------------------- (This file was created from the wiki on 2019-06-19 12:42)
Save File
Cancel