Hi Marc,

The same document says this:

rawlog binary

It works by checking if dovecot.rawlog/ directory exists in the logged in user's home directory, and writing the traffic to yyyymmdd-HHMMSS-pid.in and .out files. Each connection gets their own in/out files. *Rawlog will simply skip users who don't have the dovecot.rawlog/ directory and the performance impact for those users is minimal.*

On Wed, 30 Dec 2020 at 20:10, Marc Roos <M.Roos@f1-outsourcing.eu> wrote:

You know by any chance how to limit this only for one user?

-----Original Message----- From: Odhiambo Washington [mailto:odhiambo@gmail.com] Sent: 30 December 2020 18:00 To: dovecot Subject: Re: import_environment = $import_environment DEBUG=1 where should this be logged?

Hi Marc,

If you read the link keenly - Debugging/Rawlog - Dovecot Wiki <https://wiki.dovecot.org/Debugging/Rawlog> - you will realize that you need to do some stuff. I have done them and they produced the results.

Edit /path/to/dovecot/conf.d/10-master.conf and add the following:

Under this block:

add executable = imap postlogin to the block that has service imap { .... ... }

Then create another block in the same file as follows:

service postlogin { executable = script-login -d rawlog unix_listener postlogin { } }

Identify the user for whom you want the rawlogs:

doveadm user -u technical@mydomain.name userdb: technical@mydomain.name user : technical@mydomain.name home : /var/spool/virtual/mydomain.name/technical uid : 26 gid : 26

Now do the following: cd /var/spool/virtual/mydomain.name/technical mkdir dovecot.rawlog chown -R 26:26 dovecot.rawlog

systemctl restart dovecot (or however you do it in CentOS)

Now login to imap as the user .. perform some operations.

Now look inside /var/spool/virtual/mydomain.name/technical/dovecot.rawlog/

PS: Adapt as necessary. I tested this on FreeBSD with dovecot- 2.3.11.3

Ignore the /tmp/rawlog/%u portion of the HOWTO. I did it too, but there was nothing in /tmp/rawlog/ even though I created the directory and did chmod 1777 /tmp/rawlog.

Adios.

On Wed, 30 Dec 2020 at 19:30, Marc Roos <M.Roos@f1-outsourcing.eu> wrote:

    You can also set DEBUG environment to have rawlog log an info

message why it's not doing anything: import_environment = $import_environment DEBUG=1

    Where should this message appear, I also don't have this one.

    [1]
    https://wiki2.dovecot.org/Debugging/Rawlog

--

Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)