All Dovecot Events

Events

`auth_client_passdb_lookup_finished`

Authentication client finishes a passdb lookup.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Full username to lookup.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_passdb_lookup_started`

Authentication client starts a passdb lookup.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Full username to lookup.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_request_challenged`

Authentication client receives a request from server to continue SASL authentication.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if present.
`original_user`	Original username, if present.
`auth_user`	Auth username, if present.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_request_continued`

Authentication client continues SASL authentication by sending a response to server request.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if present.
`original_user`	Original username, if present.
`auth_user`	Auth username, if present.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_request_finished`

Authentication client receives response from server that authentication is finished, either success or failure.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if present.
`original_user`	Original username, if present.
`auth_user`	Auth username, if present.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_request_started`

Authentication client starts authentication request.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if present.
`original_user`	Original username, if present.
`auth_user`	Auth username, if present.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_userdb_list_finished`

Authentication client finishes userdb iteration.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user_mask`	User mask to list.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_userdb_list_started`

Authentication client starts userdb iteration.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user_mask`	User mask to list.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_userdb_lookup_finished`

Authentication client finishes a userdb lookup.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Full username to lookup.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_client_userdb_lookup_started`

Authentication client starts a userdb lookup.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Full username to lookup.
`error`	Error string, if error occurred.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Name of service. Examples: `imap`, `pop3`, `lmtp`, ...
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`session`	Session identifier.
`certificate_user`	Username from certificate.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`local_name`	TLS SNI.
`local_ip`	Local IP client connected to.
`remote_ip`	Remote IP of client.
`local_port`	Local port client connected to.
`remote_port`	Remote port of client.
`real_local_ip`	Real local IP as seen by the server.
`real_remote_ip`	Real remote IP as seen by the server.
`real_local_port`	Real local port as seen by the server.
`real_remote_port`	Real remote port as seen by the server.
`tls_cipher`	Cipher name used, e.g. `TLS_AES_256_GCM_SHA384`.
`tls_cipher_bits`	Cipher bits, e.g. `256`.
`tls_pfs`	Perfect forward-security mechanism, e.g. `KxANY`, `KxECDHE`.
`tls_protocol`	TLS protocol name, e.g. `TLSv1.3`.

`auth_master_client_login_finished`

Authentication master login request finished.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username of the user.
`error`	Error message if the request failed.
`id`	Login request ID.
`local_ip`	Client connection's local (server) IP.
`local_port`	Client connection's local (server) port.
`remote_ip`	Client connection's remote (client) IP.
`remote_port`	Client connection's remote (client) port.

`auth_master_client_login_started`

Authentication master login request started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`id`	Login request ID.
`local_ip`	Client connection's local (server) IP.
`local_port`	Client connection's local (server) port.
`remote_ip`	Client connection's remote (client) IP.
`remote_port`	Client connection's remote (client) port.

`auth_passdb_request_finished`

Processing has ended for a passdb block.

Most useful for debugging authentication flow.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`result`	`ok` `password_mismatch` `user_unknown` `pass_expired` `user_disabled` `scheme_not_available` `internal_failure` `next`
`cache`	`miss`: Was not cached `hit`: Found from cache
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`original_user`	Original username exactly as provided by the client.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Service doing the lookup (e.g. `imap`, `pop3`, ...).
`session`	Session ID.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`remote_ip`	Remote IP address of the client connection.
`local_ip`	Local IP address where client connected to.
`remote_port`	Remote port of the client connection.
`local_port`	Local port where the client connected to.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy's IP address.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy's IP where proxy connected to.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection's port.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to.
`local_name`	TLS SNI hostname, if given.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`passdb`	Driver name.
`passdb_name`	`passdb { name }`, if it is configured. Otherwise, same as `passdb { driver }`.
`passdb_id`	Internal ID number of the passdb. May be useful to identify the passdb if it has no name.

`auth_passdb_request_started`

Processing has begun for a passdb block.

Most useful for debugging authentication flow.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`original_user`	Original username exactly as provided by the client.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Service doing the lookup (e.g. `imap`, `pop3`, ...).
`session`	Session ID.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`remote_ip`	Remote IP address of the client connection.
`local_ip`	Local IP address where client connected to.
`remote_port`	Remote port of the client connection.
`local_port`	Local port where the client connected to.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy's IP address.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy's IP where proxy connected to.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection's port.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to.
`local_name`	TLS SNI hostname, if given.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`passdb`	Driver name.
`passdb_name`	`passdb { name }`, if it is configured. Otherwise, same as `passdb { driver }`.
`passdb_id`	Internal ID number of the passdb. May be useful to identify the passdb if it has no name.

`auth_policy_request_finished`

Processing has ended for an auth policy request.

Most useful for debugging authentication flow.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mode`	Either `allow` or `report`.
`policy_result`	Value returned from policy server (number).
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`original_user`	Original username exactly as provided by the client.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Service doing the lookup (e.g. `imap`, `pop3`, ...).
`session`	Session ID.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`remote_ip`	Remote IP address of the client connection.
`local_ip`	Local IP address where client connected to.
`remote_port`	Remote port of the client connection.
`local_port`	Local port where the client connected to.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy's IP address.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy's IP where proxy connected to.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection's port.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to.
`local_name`	TLS SNI hostname, if given.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`

`auth_request_finished`

Authentication request finished.

Most useful for tracking status of authentication/login attempts.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Set when error happens.
`success`	`yes`, when authentication succeeded.
`policy_penalty`	Time of penalty added by policy server.
`policy_result`	`ok`, `delayed`, or `refused`.
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`original_user`	Original username exactly as provided by the client.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Service doing the lookup (e.g. `imap`, `pop3`, ...).
`session`	Session ID.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`remote_ip`	Remote IP address of the client connection.
`local_ip`	Local IP address where client connected to.
`remote_port`	Remote port of the client connection.
`local_port`	Local port where the client connected to.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy's IP address.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy's IP where proxy connected to.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection's port.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to.
`local_name`	TLS SNI hostname, if given.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`

`auth_userdb_request_finished`

Processing has ended for a userdb block. This event is also sent for userdb iterations.

Most useful for debugging authentication flow.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`result`	`ok` `user_unknown` `internal_failure`
`cache`	`miss`: Was not cached `hit`: Found from cache
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`original_user`	Original username exactly as provided by the client.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Service doing the lookup (e.g. `imap`, `pop3`, ...).
`session`	Session ID.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`remote_ip`	Remote IP address of the client connection.
`local_ip`	Local IP address where client connected to.
`remote_port`	Remote port of the client connection.
`local_port`	Local port where the client connected to.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy's IP address.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy's IP where proxy connected to.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection's port.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to.
`local_name`	TLS SNI hostname, if given.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`userdb`	Driver name.
`userdb_name`	`userdb { name }`, if it is configured. Otherwise, same as `userdb { driver }`.
`userdb_id`	Internal ID number of the userdb. May be useful to identify the userdb if it has no name.

`auth_userdb_request_started`

Processing has begun for a userdb block. This event is also sent for userdb iterations.

Most useful for debugging authentication flow.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Full username. This can change during authentication, for example due to passdb lookups.
`original_user`	Original username exactly as provided by the client.
`translated_user`	Similar to `original_user`, except after `auth_username_translation` translations are applied.
`login_user`	When doing a master user login, the user we are logging in as. Otherwise not set.
`master_user`	When doing a master user login, the master username. Otherwise not set.
`mechanism`	Name of used SASL mechanism (e.g. PLAIN).
`service`	Service doing the lookup (e.g. `imap`, `pop3`, ...).
`session`	Session ID.
`client_id`	Expands to client ID request as IMAP arglist. Needs `imap_id_retain = yes`.
`remote_ip`	Remote IP address of the client connection.
`local_ip`	Local IP address where client connected to.
`remote_port`	Remote port of the client connection.
`local_port`	Local port where the client connected to.
`real_remote_ip`	Same as `remote_ip`, except if the connection was proxied this is the proxy's IP address.
`real_local_ip`	Same as `local_ip`, except if the connection was proxied this is the proxy's IP where proxy connected to.
`real_remote_port`	Same as `remote_port`, except if the connection was proxied this is the proxy connection's port.
`real_local_port`	Same as `local_port`, except if the connection was proxied this is the local port where the proxy connected to.
`local_name`	TLS SNI hostname, if given.
`transport`	Transport security indicator. Values: `insecure` `secured` Changed: 3.0.0 Secure non-TLS connections (e.g. from localhost) are now `secured` rather than `trusted`. `TLS`
`userdb`	Driver name.
`userdb_name`	`userdb { name }`, if it is configured. Otherwise, same as `userdb { driver }`.
`userdb_id`	Internal ID number of the userdb. May be useful to identify the userdb if it has no name.

`client_connection_connected`

Server accepted an incoming client connection.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`local_ip`	Local server IP address where TCP client connected to.
`remote_ip`	Remote TCP client's IP address.
`remote_port`	Remote TCP client's source port.
`remote_pid`	Remote UNIX socket client's process ID.
`remote_uid`	Remote UNIX socket client's system user ID.

`client_connection_disconnected`

Client connection is terminated.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`net_in_bytes`	Amount of data read, in bytes. Changed: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Amount of data written, in bytes. Changed: 3.0.0 This was previously `out_bytes`.
`reason`	Disconnection reason.
`local_ip`	Local server IP address where TCP client connected to.
`remote_ip`	Remote TCP client's IP address.
`remote_port`	Remote TCP client's source port.
`remote_pid`	Remote UNIX socket client's process ID.
`remote_uid`	Remote UNIX socket client's system user ID.

`cluster_user_group_move_finished`

Moving a cluster user group finished.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Error message in case group moving failed.
`failed_users`	Number of users for which moving failed.
`moved_users`	Number of users that were successfully moved.

`cluster_user_group_move_started`

Moving a cluster user group started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`cluster_user_move_finished`

Moving a cluster user finished.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Error message why moving the user failed.

`cluster_user_move_started`

Moving a cluster user started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`dict_created`

Dictionary is initialized.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`dict_name`	Name of the dict as set in configurations.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dict_destroyed`

Dictionary is destroyed.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`dict_name`	Name of the dict as set in configurations.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dict_iteration_finished`

Dictionary iteration finished.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`rows`	Number of rows returned.
`user`	Username, if it's not empty.
`key`	Key name, starts with `priv/` or `shared/`.
`key_not_found`	Set to `yes` if key not found.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dict_lookup_finished`

Dictionary lookup finishes.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if it's not empty.
`key`	Key name, starts with `priv/` or `shared/`.
`key_not_found`	Set to `yes` if key not found.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dict_server_iteration_finished`

Dictionary server finishes iteration.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`rows`	Number of rows returned.
`user`	Username, if it's not empty.
`key`	Key name, starts with `priv/` or `shared/`.
`key_not_found`	Set to `yes` if key not found.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dict_server_lookup_finished`

Dictionary server finishes lookup.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if it's not empty.
`key`	Key name, starts with `priv/` or `shared/`.
`key_not_found`	Set to `yes` if key not found.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dict_server_transaction_finished`

Dictionary server finishes transaction.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if it's not empty.
`rollback`	Set to `yes` when transaction was rolled back.
`write_uncertain`	Set to `yes` if write was not confirmed.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dict_transaction_finished`

Dictionary transaction has been committed or rolled back.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username, if it's not empty.
`rollback`	Set to `yes` when transaction was rolled back.
`write_uncertain`	Set to `yes` if write was not confirmed.
`driver`	Name of the dictionary driver, e.g. `sql` or `proxy`.
`error`	Error, if one occurred.

`dns_request_finished`

DNS request sent by DNS client library to DNS worker process has been finished.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Human readable error.
`error_code`	Error code usable with net_gethosterror().

`dns_request_started`

DNS request sent by DNS client library to DNS worker process.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`dns_worker_request_finished`

DNS request finished being processed by DNS worker process.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`cached`	Set to `yes` or `no` depending if it was a cached reply or not. Added: 3.0.0
`error`	Human readable error.
`error_code`	Error code usable with net_gethosterror().

`dns_worker_request_started`

DNS request started being processed by DNS worker process.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`fs`

May be inherited from various different parents (e.g. "Mail User" event) or even from no parent.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`fs_dictmap_dict_write_uncertain`

A dictionary write is uncertain (e.g., writes to Cassandra may eventually succeed even if the write initially appeared to fail).

See also fs_object_write_uncertain event.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`path`	Virtual FS path to the object (based on dict).
`object_id`	Object ID in the storage.
`cleanup`	`success`, `failed` or `disabled`. Indicates if uncertain write was attempted to be cleaned (deleted) and whether it was successful.
`error`	Error message why the write initially failed.

`fs_dictmap_empty_bucket_iterated`

An empty bucket is found while iterating which is not the last bucket.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened.
`empty_bucket`	Index of the empty bucket that was just discovered.
`max_bucket`	The current `max_bucket` value.
`deleted_count`	The count of deleted keys for the empty bucket.
`file_type`	`mail`: Email file `index`: Index bundle `box`: Mailbox directory (for creating/deleting it, if used by the storage driver) `fts`: FTS file
`reason`	Reason for accessing the file.

`fs_dictmap_max_bucket_changed`

This event is sent whenever the max_bucket value for a mailbox changes. There can be three situations when this happens.

A new mail is added to a mailbox, where the current bucket is found to be filled and the next bucket is started to be filled (reason = file).
Besides the expected situation, Dovecot emits this event if it encounters a bucket with a higher index then the current max_bucket while iterating a mailbox (reason = iter).
In addition max_bucket can be shrunk in case an iteration discovers empty buckets before the current max_bucket value (reason = iter).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened.
`reason`	Reason for accessing the file.
`old_max_bucket`	The `max_bucket` value for the current mailbox, before the event was emitted.
`max_bucket`	The newly set `max_bucket` value.
`error`	Error string if error occurred. Only set if setting the new `max_bucket` value failed.
`file_type`	`mail`: Email file `index`: Index bundle `box`: Mailbox directory (for creating/deleting it, if used by the storage driver) `fts`: FTS file

`fs_dictmap_object_lost`

"Object exists in dict, but not in storage" error happened.

Normally this shouldn't happen, because the writes and deletes are done in such an order that Dovecot prefers to rather leak objects in storage than cause this error. A likely source of this error can be resurrected deleted data (see Obox Troubleshooting: Object exists in dict, but not in storage for more details).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`path`	Virtual FS path to the object (based on dict).
`object_id`	Object ID in the storage.
`deleted`	Set to `yes`, if the corresponding entry in dict has been deleted as the `delete-dangling-links` option was set.

`fs_file`

Inherits from fs or any other specified event (e.g. mail).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`fs_iter`

Inherits from fs or any other specified event (e.g. mailbox).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened.
`file_type`	`mail`: Email file `index`: Index bundle `box`: Mailbox directory (for creating/deleting it, if used by the storage driver) `fts`: FTS file
`reason`	Reason for accessing the file.

`fs_object_write_uncertain`

Added: 3.0.0

Sent whenever an object write is uncertain.

When a write HTTP operation times out actual outcome is uncertain.

See also fs_dictmap_dict_write_uncertain event.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`cleanup`	`success` or `failed`. Indicates if uncertain write was cleaned (deleted) successfully
`error`	Error message why the write initially failed.

`fts_dovecot_too_many_triplets`

Emitted when number of triplets exceeds the limit defined by fts_dovecot_max_triplets.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`triplet_count`	Number of triplets found
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`http_request_finished`

HTTP request is complete.

This event is useful to track and monitor external services.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`attempts`	Amount of individual HTTP request attempts (number of retries after failures + 1).
`net_in_bytes`	Amount of data read, in bytes. Changed: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Amount of data written, in bytes. Changed: 3.0.0 This was previously `out_bytes`.
`dest_host`	Destination host.
`dest_ip`	Destination IP address.
`dest_port`	Destination port.
`method`	HTTP verb used uppercased, e.g. `GET`.
`redirects`	Number of redirects done while processing request.
`status_code`	HTTP result status code (integer).
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

`http_request_redirected`

Intermediate event emitted when an HTTP request is being redirected.

The http_request_finished is still sent at the end of the request.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`attempts`	Amount of individual HTTP request attempts (number of retries after failures + 1).
`net_in_bytes`	Amount of data read, in bytes. Changed: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Amount of data written, in bytes. Changed: 3.0.0 This was previously `out_bytes`.
`dest_host`	Destination host.
`dest_ip`	Destination IP address.
`dest_port`	Destination port.
`method`	HTTP verb used uppercased, e.g. `GET`.
`redirects`	Number of redirects done while processing request.
`status_code`	HTTP result status code (integer).
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

`http_request_retried`

Intermediate event emitted when an HTTP request is being retried.

The http_request_finished is still sent at the end of the request.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`attempts`	Amount of individual HTTP request attempts (number of retries after failures + 1).
`net_in_bytes`	Amount of data read, in bytes. Changed: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Amount of data written, in bytes. Changed: 3.0.0 This was previously `out_bytes`.
`dest_host`	Destination host.
`dest_ip`	Destination IP address.
`dest_port`	Destination port.
`method`	HTTP verb used uppercased, e.g. `GET`.
`redirects`	Number of redirects done while processing request.
`status_code`	HTTP result status code (integer).
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.

`http_server_request_finished`

HTTP request is fully completed, i.e. the incoming request body is read and the full response to the request has been sent to the client.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`net_in_bytes`	Amount of request data read, in bytes. Changed: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Amount of response data written, in bytes. Changed: 3.0.0 This was previously `out_bytes`.
`status_code`	HTTP result status code (integer).
`request_id`	Assigned ID of the received request.
`method`	HTTP verb used uppercased, e.g. `GET`.
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.
`local_ip`	Local server IP address where TCP client connected to.
`remote_ip`	Remote TCP client's IP address.
`remote_port`	Remote TCP client's source port.
`remote_pid`	Remote UNIX socket client's process ID.
`remote_uid`	Remote UNIX socket client's system user ID.

`http_server_request_started`

A new HTTP request has been received and the request headers (but not body payload) are parsed.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`request_id`	Assigned ID of the received request.
`method`	HTTP verb used uppercased, e.g. `GET`.
`target`	Request path with parameters, e.g. `/path/?delimiter=%2F&prefix=test%2F`.
`local_ip`	Local server IP address where TCP client connected to.
`remote_ip`	Remote TCP client's IP address.
`remote_port`	Remote TCP client's source port.
`remote_pid`	Remote UNIX socket client's process ID.
`remote_uid`	Remote UNIX socket client's system user ID.

`imap_client_hibernated`

IMAP client is hibernated or the hibernation attempt failed.

Note

For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Mailbox name where hibernation was started in.
`error`	Reason why hibernation attempt failed.
`user`	Username of the user.
`session`	Session ID of the IMAP connection.
`local_ip`	IMAP connection's local (server) IP.
`local_port`	IMAP connection's local (server) port.
`remote_ip`	IMAP connection's remote (client) IP.
`remote_port`	IMAP connection's remote (client) port.

`imap_client_unhibernate_retried`

An IMAP client is attempted to be unhibernated, but imap processes are busy and the unhibernation attempt is retried.

This event is sent each time when retrying is done.

The imap_client_unhibernated event is still sent when unhibernation either succeeds or fails permanently.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Reason why unhibernation failed.
`user`	Username of the user.
`session`	Session ID of the IMAP connection.
`local_ip`	IMAP connection's local (server) IP.
`local_port`	IMAP connection's local (server) port.
`remote_ip`	IMAP connection's remote (client) IP.
`remote_port`	IMAP connection's remote (client) port.

`imap_client_unhibernated`

IMAP client is unhibernated or the unhibernation attempt failed.

Note

For failures, this event can be logged by either imap or imap-hibernate process depending on which side the error was detected in.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Mailbox name where hibernation was started in.
`reason`	Reason why client was unhibernated: `idle_done`: IDLE command was stopped with DONE. `idle_bad_reply`: IDLE command was stopped with some other command than DONE. `mailbox_changes`: Mailbox change notifications need to be sent to the client.
`hibernation_usecs`	Number of microseconds how long the client was hibernated.
`user`	Username of the user.
`session`	Session ID of the IMAP connection.
`local_ip`	IMAP connection's local (server) IP.
`local_port`	IMAP connection's local (server) port.
`remote_ip`	IMAP connection's remote (client) IP.
`remote_port`	IMAP connection's remote (client) port.

`imap_command_finished`

IMAP command is completed.

This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.

Note

This event is currently not sent for pre-login IMAP commands.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`tagged_reply_state`	Values: `OK` `NO` `BAD`
`tagged_reply`	Full tagged reply (e.g. `OK SELECT finished.`).
`last_run_time`	Timestamp when the command was running last time. (Command may be followed by internal "mailbox sync" that can take some time to complete.)
`running_usecs`	How many usecs this command has spent running.
`lock_wait_usecs`	How many usecs this command has spent waiting for locks.
`net_in_bytes`	Amount of data read for this command, in bytes. Changed: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Amount of data written for this command, in bytes. Changed: 3.0.0 This was previously `out_bytes`.
`cmd_tag`	IMAP command tag.
`cmd_name`	IMAP command name uppercased (e.g. `FETCH`). Contains `unknown` for unknown command names.
`cmd_input_name`	IMAP command name exactly as sent (e.g. `fetcH`) regardless of whether or not it is valid.
`cmd_args`	IMAP command's full parameters (e.g. `1:* FLAGS`).
`cmd_human_args`	IMAP command's full parameters, as human-readable output. Often it's the same as `cmd_args`, but it is guaranteed to contain only valid UTF-8 characters and no control characters. Multi-line parameters are written only as `<N byte multi-line literal>`.
`user`	Username of the user.
`session`	Session ID of the IMAP connection.
`local_ip`	IMAP connection's local (server) IP.
`local_port`	IMAP connection's local (server) port.
`remote_ip`	IMAP connection's remote (client) IP.
`remote_port`	IMAP connection's remote (client) port.

`imap_id_received`

Added: 3.0.0

This event is emitted when the IMAP ID command was received, both for pre- as well as post-login. The parameters slightly differ for an unauthenticated client, e.g. there is no user id.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`id_param_<param>`	Received parameters. The event name is the lowercase parameter key prefixed with `id_param_`, the value is the parameter value.
`id_invalid<num>`	Each key that contains invalid characters are enumerated starting with 1. Valid characters are latin alphabetic characters (= `a` .. `z`), numerals (= `0` .. `9`), the dash (= `-`) and the underscore (= `_`), every other character is considered invalid. The value of this field is the original parameter key including invalid characters, followed by a space character, and finally the original value concatenated into a single string.
`cmd_tag`	IMAP command tag.
`cmd_name`	IMAP command name uppercased (e.g. `FETCH`). Contains `unknown` for unknown command names.
`cmd_input_name`	IMAP command name exactly as sent (e.g. `fetcH`) regardless of whether or not it is valid.
`cmd_args`	IMAP command's full parameters (e.g. `1:* FLAGS`).
`cmd_human_args`	IMAP command's full parameters, as human-readable output. Often it's the same as `cmd_args`, but it is guaranteed to contain only valid UTF-8 characters and no control characters. Multi-line parameters are written only as `<N byte multi-line literal>`.
`user`	Username of the user.
`session`	Session ID of the IMAP connection.
`local_ip`	IMAP connection's local (server) IP.
`local_port`	IMAP connection's local (server) port.
`remote_ip`	IMAP connection's remote (client) IP.
`remote_port`	IMAP connection's remote (client) port.

`indexer_worker_indexing_finished`

Indexer worker process completed an indexing transaction.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`message_count`	Number of messages indexed.
`first_uid`	UID of the first indexed message.
`last_uid`	UID of the last indexed message.
`user_cpu_usecs`	Total user CPU spent on the indexing transaction in microseconds.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`login_aborted`

Added: 3.0.0

reason values:

Reason	Description
`anonymous_auth_disabled`	Anonymous authentication is not allowed.
`authorization_failed`	Master user authentication succeeded, but authorization to access the requested login user wasn't allowed.
`auth_aborted_by_client`	Client started SASL authentication, but returned "*" reply to abort it.
`auth_failed`	Generic authentication failure. Possibly due to invalid username/password, but could have been some other unspecified reason also.
`auth_nologin_referral`	Authentication returned auth referral to redirect the client to another server. This is normally configured to be sent only when the client is a Dovecot proxy, which handles the redirection.
`auth_process_comm_fail`	Internal error communicating with the auth process.
`auth_process_not_ready`	Client disconnected before auth process was ready. This may indicate a hanging auth process if `connected_usecs` is large.
`auth_waiting_client`	Client started SASL authentication, but disconnected instead of sending the next SASL continuation reply.
`cleartext_auth_disabled`	Authentication using cleartext mechanism is not allowed at this point. It would be allowed if SSL/TLS was enabled.
`client_ssl_cert_untrusted`	Client sent an SSL certificate that is untrusted with `auth_ssl_require_client_cert = yes`.
`client_ssl_cert_missing`	Client didn't send SSL certificate, but `auth_ssl_require_client_cert = yes`.
`client_ssl_not_started`	Client didn't even start SSL with `auth_ssl_require_client_cert = yes`.
`connection_limit`	Client reached `mail_max_userip_connections` limit.
`internal_failure`	Internal failure. The error log has more details.
`invalid_base64`	Client sent invalid base64 in SASL response.
`invalid_mech`	Unknown SASL authentication mechanism requested.
`login_disabled`	The user has the authentication nologin extra field field set in passdb and is thereby not able to login.
`no_auth_attempts`	Client didn't send any authentication attempts.
`password_expired`	The user's password is expired.
`process_full`	service configuration (client_limit) and service configuration (process_limit) was hit and this login session was killed.
`shutting_down`	The process is shutting down so the login is aborted.
`tls_handshake_not_finished`	TLS handshake failed or was not finished.
`user_disabled`	User is in deny passdb, or in some other way disabled passdb.

Proxying reason values:

Reason	Description
`proxy_dest_connect_failed`	Local authentication succeeded, but connection to destination hop failed.
`proxy_dest_internal_failure`	Local authentication succeeded, but internal failure occurred after that.
`proxy_dest_remote_failure`	Local authentication succeeded, but destination hop reported unspecified failure.
`proxy_dest_protocol_failure`	Local authentication succeeded, but destination hop unexpectedly violated the protocol standard.
`proxy_dest_auth_failed`	Local authentication succeeded, but proxying failed to authenticate to the destination hop.
`proxy_dest_auth_temp_failed`	Local authentication succeeded, but proxying failed to temporarily authenticate to the destination hop.
`proxy_dest_redirected`	Local authentication succeeded, but destination hop redirected to another host.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`reason`	Short reason; see the short reason to description mapping.
`auth_successes`	Number of successful authentications, which eventually failed due to other reasons.
`auth_attempts`	Total number of authentication attempts, both successful and failed.
`auth_usecs`	How long ago the first authentication attempt was started.
`connected_usecs`	How long ago the client connection was created.
`local_ip`	Local IP address.
`local_port`	Local port.
`remote_ip`	Remote IP address.
`remote_port`	Remote port.
`user`	Full username.
`service`	Name of service e.g. `submission`, `imap`.

`mail_cache_corrupted`

Cache file was found to be corrupted and the whole file is deleted.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`reason`	Reason string why cache was found to be corrupted.

`mail_cache_decision_changed`

A field's caching decision changed.

Decisions:

Decision	Description
`no`	The field is not cached.
`temp`	The field is cached for 1 week and dropped on the next purge.
`yes`	The field is cached permanently. If the field isn't accessed for 30 days it's dropped.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`field`	Cache field name (e.g. `imap.body` or `hdr.from`).
`last_used`	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.
`reason`	Reason why the caching decision changed: `add`: no -> temp decision change, because a new field was added to cache. `old_mail`: temp -> yes decision change, because a mail older than 1 week was accessed. `unordered_access`: temp -> yes decision change, because mails weren't accessed in ascending order. Other values indicate a reason for cache purging, which changes the caching decision yes -> temp.
`uid`	IMAP UID number that caused the decision change. This is set only for some reasons, not all.
`old_decision`	Old cache decision.
`new_decision`	New cache decision.

`mail_cache_decision_rejected`

The decision to promote a field (from no to temp) was rejected.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`field`	Cache field name (e.g. `hdr.from`).
`reason`	Reason why the caching decision changed: `too_many_headers` : This can happen when the count of headers in the cache exceeds the maximum configured with `mail_cache_max_headers_count`.

`mail_cache_purge_drop_field`

Existing field is dropped from the cache file because it hadn't been accessed for 30 days.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`field`	Cache field name (e.g. `imap.body` or `hdr.from`).
`decision`	Old caching decision: `temp`, or `yes`.
`last_used`	UNIX timestamp of when the field was accessed the last time. This is updated only once per 24 hours.
`file_seq`	Sequence of the new cache file that is created.
`prev_file_seq`	Sequence of the cache file that is to be purged.
`prev_file_size`	Size of the cache file that is to be purged.
`prev_deleted_records`	Number of records (mails) marked as deleted in the cache file that is to be purged.
`reason`	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index

`mail_cache_purge_finished`

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`file_size`	Size of the new cache file.
`max_uid`	IMAP UID of the last mail in the cache file.
`file_seq`	Sequence of the new cache file that is created.
`prev_file_seq`	Sequence of the cache file that is to be purged.
`prev_file_size`	Size of the cache file that is to be purged.
`prev_deleted_records`	Number of records (mails) marked as deleted in the cache file that is to be purged.
`reason`	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index

`mail_cache_purge_started`

Cache file purging is started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`file_seq`	Sequence of the new cache file that is created.
`prev_file_seq`	Sequence of the cache file that is to be purged.
`prev_file_size`	Size of the cache file that is to be purged.
`prev_deleted_records`	Number of records (mails) marked as deleted in the cache file that is to be purged.
`reason`	Reason string for purging the cache file: doveadm mailbox cache purge copy cache decisions creating cache cache is too large syncing rebuilding index

`mail_cache_record_corrupted`

Cache record for a specific mail was found to be corrupted and the record is deleted.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`reason`	Reason string why cache was found to be corrupted.
`uid`	IMAP UID of the mail whose cache record is corrupted.

`mail_delivery_finished`

Message delivery is completed.

This event is useful for logging and tracking mail deliveries.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Error message if the delivery failed.
`message_id`	Message-ID header value (truncated to 200 bytes).
`message_subject`	Subject header value, in UTF-8 (truncated to 80 bytes).
`message_from`	Email address in the From header (e.g. `user@example.com`).
`message_size`	Size of the message, in bytes.
`message_vsize`	Size of the message with CRLF linefeeds, in bytes.
`rcpt_to`	Recipient address.
`rcpt_param_notify`	The value of the NOTIFY parameter for the RCPT command.
`rcpt_param_orcpt`	The address value of the ORCPT parameter for the RCPT command.
`rcpt_param_orcpt_type`	The address type (typically "rfc822") of the ORCPT parameter for the RCPT command.
`session`	The session ID for this connection (same as `connection_id`).
`transaction_id`	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
`mail_from`	Sender address.
`mail_param_auth`	The value of the AUTH parameter for the MAIL command.
`mail_param_body`	The value of the BODY parameter for the MAIL command.
`mail_param_envid`	The value of the ENVID parameter for the MAIL command.
`mail_param_ret`	The value of the RET parameter for the MAIL command.
`mail_param_size`	The value of the SIZE parameter for the MAIL command.
`data_size`	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
`connection_id`	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
`protocol`	The protocol used by the connection; i.e., either `smtp` or `lmtp`.

`mail_delivery_started`

Message delivery has started.

This event is useful for debugging mail delivery flow.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`message_id`	Message-ID header value (truncated to 200 bytes).
`message_subject`	Subject header value, in UTF-8 (truncated to 80 bytes).
`message_from`	Email address in the From header (e.g. `user@example.com`).
`message_size`	Size of the message, in bytes.
`message_vsize`	Size of the message with CRLF linefeeds, in bytes.
`rcpt_to`	Recipient address.
`rcpt_param_notify`	The value of the NOTIFY parameter for the RCPT command.
`rcpt_param_orcpt`	The address value of the ORCPT parameter for the RCPT command.
`rcpt_param_orcpt_type`	The address type (typically "rfc822") of the ORCPT parameter for the RCPT command.
`session`	The session ID for this connection (same as `connection_id`).
`transaction_id`	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
`mail_from`	Sender address.
`mail_param_auth`	The value of the AUTH parameter for the MAIL command.
`mail_param_body`	The value of the BODY parameter for the MAIL command.
`mail_param_envid`	The value of the ENVID parameter for the MAIL command.
`mail_param_ret`	The value of the RET parameter for the MAIL command.
`mail_param_size`	The value of the SIZE parameter for the MAIL command.
`data_size`	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
`connection_id`	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
`protocol`	The protocol used by the connection; i.e., either `smtp` or `lmtp`.

`mail_expunge_requested`

A mail is set to be expunged.

Note

Expunges can be rolled back later on, this event is emitted when an expunge is requested.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`seq`	Mail sequence number.
`uid`	Mail IMAP UID number.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`mail_expunged`

A mail was expunged from the mailbox.

Note

This event inherits from mailbox, not mail.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`uid`	UID of the expunged mail.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`mail_index_recreated`

A mail index file was recreated.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`filepath`	Path to the index file being recreated.
`reason`	Human-readable reason why the mail index was recreated.

`mail_metadata_accessed`

Added: 3.0.0

A mail was opened for reading its metadata.

Note

This event is not sent when mails' body is accessed.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`seq`	Mail sequence number.
`uid`	Mail IMAP UID number.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`mail_opened`

A mail was opened, e.g., for reading its body.

Note

This event is not sent when mails' metadata is accessed, even if it causes opening the mail file.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`reason`	Reason why the mail was opened. (optional)
`seq`	Mail sequence number.
`uid`	Mail IMAP UID number.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`mail_user_session_finished`

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`utime`	User CPU time used in microseconds.
`stime`	System CPU time used in microseconds.
`minor_faults`	Page reclaims (soft page faults).
`major_faults`	Page faults (hard page faults).
`vol_cs`	Voluntary context switches.
`invol_cs`	Involuntary context switches.
`rss`	Resident set size in bytes. (Skipped in non-Linux environments.)
`vsz`	Virtual memory size in bytes. (Skipped in non-Linux environments.)
`rchar`	I/O counter: chars (bytes) read from storage. (Skipped in non-Linux environments.)
`wchar`	I/O counter: chars (bytes) written to storage. (Skipped in non-Linux environments.)
`syscr`	Number of read syscalls. (Skipped in non-Linux environments.)
`syscw`	Number of write syscalls. (Skipped in non-Linux environments.)
`net_in_bytes`	Bytes received during this session (for applicable processes.) Added: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Bytes sent during this session (for applicable processes.) Added: 3.0.0 This was previously `out_bytes`.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`managesieve_command_finished`

Finished the ManageSieve command.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`script_name`	Name for the Sieve script this command operated on (if any).
`old_script_name`	Old name of the Sieve script (only set for RENAMESCRIPT).
`new_script_name`	New name for the Sieve script (only set for RENAMESCRIPT).
`compile_errors`	The number of compile errors that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when compile fails).
`compile_warnings`	The number of compile warnings that occurred (only set for PUTSCRIPT, CHECKSCRIPT and SETACTIVE when script is compiled).
`cmd_name`	Name of the ManageSieve command.
`cmd_args`	Arguments for the ManageSieve command.
`error`	Error message for when the command failed.

`message_hashing_msg_full`

If message-hashing plugin is loaded, emitted for every message saved.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`append`	If `1`, the message was saved via IMAP APPEND.
`attachments`	The number of attachments processed in this message (attachments with size > `min_atc_size`).
`hash`	The calculated hash of the entire message.
`size`	The size (in bytes) of the entire message.

`message_hashing_msg_part`

If message-hashing plugin is loaded, emitted for every attachment found when a message is saved.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`append`	If `1`, the message was saved via IMAP APPEND.
`hash`	The calculated hash of the attachment.
`size`	The size (in bytes) of the attachment.

`metacache_mailbox_bundle_download_finished`

Mailbox index bundle file was downloaded (can happen while the mailbox is being refreshed).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`error`	Error message if the download failed.

`metacache_mailbox_bundle_download_started`

Mailbox index bundle file is being downloaded (can happen while the mailbox is being refreshed).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`error`	Error message if the download failed.

`metacache_mailbox_bundle_upload_finished`

Mailbox index bundle file was uploaded. Can happen while the mailbox is being uploaded.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`mailbox_guid`	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`error`	Error message if the upload failed.

`metacache_mailbox_bundle_upload_started`

Mailbox index bundle file is being uploaded. Can happen while the mailbox is being uploaded.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`mailbox_guid`	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`error`	Error message if the upload failed.

`metacache_mailbox_refresh_finished`

Metacache was refreshed when mailbox is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn't sent if the metacache is used without refreshing.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`metacache_status`	Status of the refresh operation: `refreshed_changed`: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. `refreshed_unchanged`: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`rescan`	`yes`, if mailbox is going to be rescanned.
`error`	Error message if the refresh failed.

`metacache_mailbox_refresh_started`

Metacache is being refreshed when mailbox is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn't sent if the metacache is used without refreshing.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`metacache_status`	Status of the refresh operation: `refreshed_changed`: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. `refreshed_unchanged`: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`rescan`	`yes`, if mailbox is going to be rescanned.
`error`	Error message if the refresh failed.

`metacache_pull_finished`

Metacache pulling has finished.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`source_host`	Which host metacache is being pulled from.
`type`	`server`: The event is emitted by the host that metacache is being pulled from. (This host is `source_host`.) `client`: The event is emitted by the host that is pulling metacache from `source_host`.
`exit_code`	Exit code for finished metacache pull commands. If the command finished successfully it is `0`. The exit codes are the same as doveadm exit codes.
`error`	Error message if metacache pull failed.

`metacache_pull_started`

Metacache pulling has started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`source_host`	Which host metacache is being pulled from.
`type`	`server`: The event is emitted by the host that metacache is being pulled from. (This host is `source_host`.) `client`: The event is emitted by the host that is pulling metacache from `source_host`.
`exit_code`	Exit code for finished metacache pull commands. If the command finished successfully it is `0`. The exit codes are the same as doveadm exit codes.
`error`	Error message if metacache pull failed.

`metacache_upload_finished`

Changes in metacache were uploaded to storage.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Error message if the upload failed.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID

`metacache_upload_started`

Changes in metacache are being uploaded to storage.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Error message if the upload failed.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID

`metacache_user_bundle_download_finished`

User index bundle file was downloaded (can happen while the user is being refreshed).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`error`	Error message if the download failed.

`metacache_user_bundle_download_started`

User index bundle file is being downloaded (can happen while the user is being refreshed).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`error`	Error message if the download failed.

`metacache_user_bundle_upload_finished`

User index bundle file was uploaded. Can happen while the user is being uploaded.

Note

This event can be inherited from a mailbox event, and include the mailbox fields, if the user upload was triggered by a mailbox upload.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`mailbox_guid`	GUID of the mailbox being uploaded. Note that the mailbox name field may or may not exist in this event depending on whether a single mailbox or the whole user is being uploaded.
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`error`	Error message if the upload failed.

`metacache_user_bundle_upload_started`

User index bundle file is being uploaded. Can happen while the user is being uploaded.

Note

This event can be inherited from a mailbox event, and include the mailbox fields, if the user upload was triggered by a mailbox upload.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`filename`	Bundle filename.
`bundle_type`	Bundle type: `diff`, `base`, or `self`.
`bundle_size`	Size of the bundle file in bytes (uncompressed).
`mailbox_guid`	Mailbox GUID
`reason`	Reason for what changed in the indexes to cause this bundle to be created and uploaded.
`error`	Error message if the upload failed.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`mailbox`	Full mailbox name in UTF-8

`metacache_user_clean_finished`

User is finished being cleaned from metacache.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`min_priority`	Which priority indexes are being cleaned.
`error`	Error message if the upload failed.

`metacache_user_clean_started`

User is started to be cleaned from metacache, either entirely or only partially (only low priority files).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`min_priority`	Which priority indexes are being cleaned.
`error`	Error message if the upload failed.

`metacache_user_refresh_finished`

Metacache was refreshed when user is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn't sent if the metacache is used without refreshing.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`metacache_status`	Status of the refresh operation: `refreshed_changed`: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. `refreshed_unchanged`: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`rescan`	`yes`, if mailbox is going to be rescanned.
`error`	Error message if the refresh failed.

`metacache_user_refresh_started`

Metacache is being refreshed when user is being accessed. Sent only when a storage operation is done to perform the refresh; the event isn't sent if the metacache is used without refreshing.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0
`metacache_status`	Status of the refresh operation: `refreshed_changed`: Bundles were listed in storage. New bundles were found and downloaded. This is used also when an existing mailbox is first downloaded to metacache. `refreshed_unchanged`: Bundles were listed in storage, but no new changes were found. kept: Local metacache was used without any storage operations. created: A new user or mailbox is being created.
`rescan`	`yes`, if mailbox is going to be rescanned.
`error`	Error message if the refresh failed.

`obox_index_merge_finished`

Mailbox index merging was finished.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`obox_index_merge_skip_uid_renumbering`

Index merging should have renumbered UIDs due to conflicts, but there were too many of them (more than metacache_merge_max_uid_renumbers, so no renumbering was done after all.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`renumber_count`	Number of UIDs that should have been renumbered.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`obox_index_merge_started`

Mailbox index merging was started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`obox_index_merge_uids_renumbered`

Index merging required changing some mails' IMAP UIDs because they conflicted between the two indexes.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`renumber_count`	Number of UIDs that were renumbered.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`obox_index_merge_uidvalidity_changed`

Index merging required changing the mailbox's IMAP UIDVALIDITY.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Full mailbox name in UTF-8
`mailbox_guid`	Mailbox GUID
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`obox_mailbox_rebuild_finished`

Mailbox was rebuilt. A rebuild happens after some kind of corruption had been detected. All mails in the storage are listed and synced against the local indexes in metacache.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to "Object exists in dict, but not in storage".
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_total`	Number of mails that exists in the mailbox now.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`error`	Error message if the rescan/rebuild failed.

`obox_mailbox_rebuild_started`

Mailbox is being rebuilt. A rebuild happens after some kind of corruption had been detected. All mails in the storage are listed and synced against the local indexes in metacache.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to "Object exists in dict, but not in storage".
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_total`	Number of mails that exists in the mailbox now.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`error`	Error message if the rescan/rebuild failed.

`obox_mailbox_rescan_finished`

Mailbox was rescanned. A rescan happens when a mailbox is opened for the first time in this backend (or after it was cleaned away). All mails in the storage are listed and synced against the local indexes in metacache.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to "Object exists in dict, but not in storage".
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_total`	Number of mails that exists in the mailbox now.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`error`	Error message if the rescan/rebuild failed.

`obox_mailbox_rescan_started`

Mailbox is being rescanned. A rescan happens when a mailbox is opened for the first time in this backend (or after it was cleaned away). All mails in the storage are listed and synced against the local indexes in metacache.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mails_new`	Number of new mails found.
`mails_temp_lost`	Number of mails temporarily lost due to "Object exists in dict, but not in storage".
`mails_lost`	Number of mails that existed in index, but no longer exists in storage.
`mails_lost_during_resync`	Number of new mails found, but when doing GUID the mail no longer existed.
`mails_kept`	Number of mails found in both the index and in storage.
`mails_total`	Number of mails that exists in the mailbox now.
`guid_lookups`	Number of mails whose GUIDs were looked up from the email metadata.
`guid_lookups_skipped`	Number of mails whose GUIDs were not looked up due to reaching the GUID lookup limit.
`error`	Error message if the rescan/rebuild failed.

`obox_save_throttling`

Obox is throttling the number of concurrent saves/copies.

This event is used to expose externally the status of the internal parallelism, i.e. to let tests assess if we can actually reach the degree of parallelism expected through obox_max_parallel_writes and obox_max_parallel_copies or if instead anything chokes the performance to less optimal levels.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`pending_save`	Number of message saves pending completion.
`pending_copy`	Number of message copies pending completion.

`pop3_command_finished`

Added: 3.0.0

POP3 command is completed.

This event is useful to track individual command usage, debug specific sessions, and/or detect broken clients.

Note

This event is currently not sent for pre-login POP3 commands.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`reply`	POP3 reply. Values: `OK` `FAIL`
`net_in_bytes`	Amount of data read for this command, in bytes.
`net_out_bytes`	Amount of data written for this command, in bytes.
`cmd_name`	POP3 command name uppercased (e.g. `UIDL`).
`cmd_args`	POP3 command's full parameters (e.g. `1 1`).
`user`	Username of the user.
`session`	Session ID of the POP3 connection.
`local_ip`	POP3 connection's local (server) IP.
`local_port`	POP3 connection's local (server) port.
`remote_ip`	POP3 connection's remote (client) IP.
`remote_port`	POP3 connection's remote (client) port.

`proxy_session_established`

Connection to proxy destination is established and user is successfully logged into the backend.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`source_port`	Source port where proxy connection originated from.
`reconnect_attempts`	Number of times connection failed and reconnection was attempted.
`dest_host`	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as `dest_ip`).
`dest_ip`	Proxy destination IP.
`dest_port`	Proxy destination port.
`source_ip`	Source IP where proxy connection originated from.
`master_user`	If proxying is done with a master user authentication, contains the full username of master user.
`local_ip`	Local IP address.
`local_port`	Local port.
`remote_ip`	Remote IP address.
`remote_port`	Remote port.
`user`	Full username.
`service`	Name of service e.g. `submission`, `imap`.

`proxy_session_finished`

Connection to proxy destination has ended, either successfully or with error.

List of error codes:

Error Code	Explanation
`authorization_failed`	User authorization failed.
`temp_fail`	Auth service reported temporary failure.
`user_disabled`	User is disabled.
`password_expired`	Password is expired.
`invalid_base64`	Challenge response was invalid base64 encoded.
`login_disabled`	Login is disabled.
`invalid_mech`	Used mechanism isn't supported.
`cleartext_auth_disabled`	Cleartext authentication is not enabled, use TLS.
`anonymous_auth_disabled`	Anonymous authentication is not enabled.

Proxying error codes:

Reason	Description
`proxy_dest_connect_failed`	Local authentication succeeded, but connection to destination hop failed.
`proxy_dest_internal_failure`	Local authentication succeeded, but internal failure occurred after that.
`proxy_dest_remote_failure`	Local authentication succeeded, but destination hop reported unspecified failure.
`proxy_dest_protocol_failure`	Local authentication succeeded, but destination hop unexpectedly violated the protocol standard.
`proxy_dest_auth_failed`	Local authentication succeeded, but proxying failed to authenticate to the destination hop.
`proxy_dest_auth_temp_failed`	Local authentication succeeded, but proxying failed to temporarily authenticate to the destination hop.
`proxy_dest_redirected`	Local authentication succeeded, but destination hop redirected to another host.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	If login to destination failed, contains the error.
`error_code`	If login to destination failed, contains the error code. Added: 3.0.0
`disconnect_side`	Which side disconnected: `client`, `server`, `proxy`.
`disconnect_reason`	Reason for disconnection (empty = clean disconnect).
`idle_usecs`	Number of seconds the connection was idling before getting disconnected. Changed: 3.0.0 This was previously named `idle_secs`.
`net_in_bytes`	Amount of data read from client, in bytes. Changed: 3.0.0 This was previously `in_bytes`.
`net_out_bytes`	Amount of data written to client, in bytes. Changed: 3.0.0 This was previously `out_bytes`.
`source_port`	Source port where proxy connection originated from.
`reconnect_attempts`	Number of times connection failed and reconnection was attempted.
`dest_host`	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as `dest_ip`).
`dest_ip`	Proxy destination IP.
`dest_port`	Proxy destination port.
`source_ip`	Source IP where proxy connection originated from.
`master_user`	If proxying is done with a master user authentication, contains the full username of master user.
`local_ip`	Local IP address.
`local_port`	Local port.
`remote_ip`	Remote IP address.
`remote_port`	Remote port.
`user`	Full username.
`service`	Name of service e.g. `submission`, `imap`.

`proxy_session_started`

Connection to proxy destination has started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`dest_host`	Host name of the proxy destination (if proxying is configured with IP address, will have the same value as `dest_ip`).
`dest_ip`	Proxy destination IP.
`dest_port`	Proxy destination port.
`source_ip`	Source IP where proxy connection originated from.
`master_user`	If proxying is done with a master user authentication, contains the full username of master user.
`local_ip`	Local IP address.
`local_port`	Local port.
`remote_ip`	Remote IP address.
`remote_port`	Remote port.
`user`	Full username.
`service`	Name of service e.g. `submission`, `imap`.

`push_notification_finished`

Push notification event was sent. See push notification stats.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`mailbox`	Mailbox for event.
`user`	Username of the user.
`session`	Session ID for the storage session.
`service`	Name of the service. Examples: `imap`, `pop3`, `lmtp`, ... Added: 3.0.0

`server_connection_connected`

Outgoing server connection was either successfully established or failed.

Note

Currently it is not possible to know which one happened.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`source_ip`	Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested.
`dest_ip`	TCP connection's destination IP address.
`dest_port`	TCP connection's destination port.
`dest_host`	TCP connection's destination hostname, if known.
`socket_path`	UNIX socket connection's path.
`remote_pid`	Remote UNIX socket server's process ID.
`remote_uid`	Remote UNIX socket server's system user ID.

`server_connection_disconnected`

Server connection is terminated.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`reason`	Disconnection reason.
`source_ip`	Source IP address used for the outgoing TCP connection. This is set only if a specific source IP was explicitly requested.
`dest_ip`	TCP connection's destination IP address.
`dest_port`	TCP connection's destination port.
`dest_host`	TCP connection's destination hostname, if known.
`socket_path`	UNIX socket connection's path.
`remote_pid`	Remote UNIX socket server's process ID.
`remote_uid`	Remote UNIX socket server's system user ID.

`sieve_action_finished`

Emitted when sieve action is completed successfully.

Field List

Field Description

duration

Duration of the event (in microseconds)

reason_code

List of reason code strings why the event happened. See event reasons for possible values.

action_name

Action	Description
`discard`	The discard action was executed successfully (only has an effect when no explicit keep is executed).
ileinto`	The fileinto action was executed successfully.
`keep`	The keep action was executed successfully (maps to fileinto internally, so the fields are identical).
`notify`	The notify action was executed successfully (either from the notify or the enotify extension).
`pipe`	The pipe action (from vnd.dovecot.pipe extension) was executed successfully.
`redirect`	The redirect action was executed successfully.
`reject`	The reject action was executed successfully.
`report`	The report action (from vnd.dovecot.report extension) was executed successfully.
`vacation`	The vacation action was executed successfully.

action_script_location

The location string for this Sieve action (a combination of "<script-name>: line <number>".

redirect_target

The target address for the redirect action.

notify_target

The list of target addresses for the notify action.

report_target

The target address for the report action.

report_type

The feedback type for the report action.

fileinto_mailbox

The target mailbox for the fileinto/keep action.

pipe_program

The name of the program being executed by the pipe action.

message_id

The message-id of the message being filtered.

mail_from

Envelope sender address if available.

rcpt_to

Envelope recipient address if available.

user

Username of the user.

`sieve_runtime_script_finished`

Finished evaluating a Sieve script.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`script_name`	The name of the Sieve script as it is visible to the user.
`script_location`	The full location string of the Sieve script.
`binary_path`	The path of the Sieve binary being executed (if it is not only in memory).
`error`	If present, this field indicates that the script execution has failed. The error message itself is very simple.
`message_id`	The message-id of the message being filtered.
`mail_from`	Envelope sender address if available.
`rcpt_to`	Envelope recipient address if available.
`user`	Username of the user.

`sieve_runtime_script_started`

Started evaluating a Sieve script.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`script_name`	The name of the Sieve script as it is visible to the user.
`script_location`	The full location string of the Sieve script.
`binary_path`	The path of the Sieve binary being executed (if it is not only in memory).
`error`	If present, this field indicates that the script execution has failed. The error message itself is very simple.
`message_id`	The message-id of the message being filtered.
`mail_from`	Envelope sender address if available.
`rcpt_to`	Envelope recipient address if available.
`user`	Username of the user.

`sieve_script_activated`

Activated a Sieve script.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).
`script_location`	The location string for the Sieve script.
`error`	Error message for when storage operation has failed.
`user`	Username of the user.

`sieve_script_closed`

Closed a Sieve script (after reading it).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).
`script_location`	The location string for the Sieve script.
`error`	Error message for when storage operation has failed.
`user`	Username of the user.

`sieve_script_deleted`

Deleted a Sieve script.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).
`script_location`	The location string for the Sieve script.
`error`	Error message for when storage operation has failed.
`user`	Username of the user.

`sieve_script_opened`

Opened a Sieve script for reading (e.g. for ManageSieve GETSCRIPT or compiling it at delivery).

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).
`script_location`	The location string for the Sieve script.
`error`	Error message for when storage operation has failed.
`user`	Username of the user.

`sieve_script_renamed`

Renamed a Sieve script.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`old_script_name`	Old name of the Sieve script.
`new_script_name`	New name for the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).
`script_location`	The location string for the Sieve script.
`error`	Error message for when storage operation has failed.
`user`	Username of the user.

`sieve_storage_save_finished`

Finished saving a Sieve script.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`script_name`	Name of the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).
`script_location`	The location string for the Sieve script.
`error`	Error message for when storage operation has failed.
`user`	Username of the user.

`sieve_storage_save_started`

Started saving a Sieve script.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`script_name`	Name of the Sieve script.
`storage_driver`	The driver name of the Sieve storage (`file`, `ldap`, or `dict`).
`script_location`	The location string for the Sieve script.
`error`	Error message for when storage operation has failed.
`user`	Username of the user.

`smtp_server_command_finished`

The command is finished. Either a success reply was sent for it or it failed somehow.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`status_code`	SMTP status code for the (first) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).
`enhanced_code`	SMTP enhanced status code for the (first) reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely).
`error`	Error message for the reply. There is no field for a success message.
`cmd_name`	Name of the command.
`cmd_input_name`	SMTP command name exactly as sent (e.g. `MaIL`) regardless of whether or not it is valid.
`cmd_args`	SMTP command's full parameters (e.g. `<from@example.com>`).
`cmd_human_args`	SMTP command's full parameters, as human-readable output. For SMTP, this is currently identical to `cmd_args`.
`connection_id`	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
`protocol`	The protocol used by the connection; i.e., either `smtp` or `lmtp`.
`session`	The session ID for this connection (same as `connection_id`).

`smtp_server_command_started`

The command is received from the client.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`cmd_name`	Name of the command.
`cmd_input_name`	SMTP command name exactly as sent (e.g. `MaIL`) regardless of whether or not it is valid.
`cmd_args`	SMTP command's full parameters (e.g. `<from@example.com>`).
`cmd_human_args`	SMTP command's full parameters, as human-readable output. For SMTP, this is currently identical to `cmd_args`.
`connection_id`	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
`protocol`	The protocol used by the connection; i.e., either `smtp` or `lmtp`.
`session`	The session ID for this connection (same as `connection_id`).

`smtp_server_transaction_finished`

Transaction is finished or failed.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`status_code`	SMTP status code for the (first failure) reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).
`enhanced_code`	SMTP enhanced status code for the (first failure) reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely).
`error`	Error message for the first failure reply. There is no field for a success message.
`recipients`	Total number of recipients.
`recipients_aborted`	The number of recipients that got aborted before these could either finish or fail. This means that the transaction failed early somehow while these recipients were still being processed by the server.
`recipients_denied`	The number of recipients denied by the server using a negative reply to the RCPT command.
`recipients_failed`	The number of recipients that failed somehow (includes denied recipients, but not aborted recipients).
`recipients_succeeded`	The number of recipients for which the transaction finally succeeded.
`is_reset`	The transaction was reset (RSET) rather than finishing with a DATA/BDAT command as it normally would. This happens when client side issues the RSET command. Note that a reset event is a success (no error field is present).
`transaction_id`	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
`session`	The session ID for this connection (same as `connection_id`).
`mail_from`	Sender address.
`mail_param_auth`	The value of the AUTH parameter for the MAIL command.
`mail_param_body`	The value of the BODY parameter for the MAIL command.
`mail_param_envid`	The value of the ENVID parameter for the MAIL command.
`mail_param_ret`	The value of the RET parameter for the MAIL command.
`mail_param_size`	The value of the SIZE parameter for the MAIL command.
`data_size`	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
`connection_id`	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
`protocol`	The protocol used by the connection; i.e., either `smtp` or `lmtp`.

`smtp_server_transaction_rcpt_finished`

The transaction is finished or failed for this particular recipient. When successful, this means the DATA command for the transaction yielded success for that recipient (even for SMTP this event is generated for each recipient separately). Recipients can fail at various stages, particularly at the actual RCPT command where the server can deny the recipient.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`status_code`	SMTP status code for the reply. This is = 9000 for aborted commands (e.g., when the connection is closed prematurely).
`enhanced_code`	SMTP enhanced status code for the reply. This is "9.0.0" for aborted commands (e.g., when the connection is closed prematurely).
`error`	Error message for the reply if it is a failure. There is no field for a success message.
`dest_host`	LMTP proxying only: Proxy destination hostname. Added: 3.0.0
`dest_ip`	LMTP proxying only: Proxy destination IP address. Added: 3.0.0
`rcpt_to`	Recipient address.
`rcpt_param_notify`	The value of the NOTIFY parameter for the RCPT command.
`rcpt_param_orcpt`	The address value of the ORCPT parameter for the RCPT command.
`rcpt_param_orcpt_type`	The address type (typically "rfc822") of the ORCPT parameter for the RCPT command.
`session`	The session ID for this connection (same as `connection_id`).
`transaction_id`	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
`mail_from`	Sender address.
`mail_param_auth`	The value of the AUTH parameter for the MAIL command.
`mail_param_body`	The value of the BODY parameter for the MAIL command.
`mail_param_envid`	The value of the ENVID parameter for the MAIL command.
`mail_param_ret`	The value of the RET parameter for the MAIL command.
`mail_param_size`	The value of the SIZE parameter for the MAIL command.
`data_size`	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
`connection_id`	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
`protocol`	The protocol used by the connection; i.e., either `smtp` or `lmtp`.

`smtp_server_transaction_started`

The transaction is started.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`transaction_id`	Transaction ID used by the server for this transaction (this ID is logged, mentioned in the DATA reply and part of the "Received:" header). It is based on the connection_id with a ":<seq>" sequence number suffix.
`session`	The session ID for this connection (same as `connection_id`).
`mail_from`	Sender address.
`mail_param_auth`	The value of the AUTH parameter for the MAIL command.
`mail_param_body`	The value of the BODY parameter for the MAIL command.
`mail_param_envid`	The value of the ENVID parameter for the MAIL command.
`mail_param_ret`	The value of the RET parameter for the MAIL command.
`mail_param_size`	The value of the SIZE parameter for the MAIL command.
`data_size`	The number data of bytes received from the client. This field is only present when the transaction finished receiving the DATA command.
`connection_id`	The session ID for this connection. The connection ID is forwarded through proxies, allowing correlation between sessions on frontend and backend systems.
`protocol`	The protocol used by the connection; i.e., either `smtp` or `lmtp`.

`smtp_submit_finished`

Finished the message submission.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Error message for submission failure.
`mail_from`	The envelope sender for the outgoing message.
`recipients`	The number of recipients for the outgoing message.
`data_size`	The size of the outgoing message.

`smtp_submit_started`

Started message submission.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`sql_connection_finished`

Connection to SQL server is closed.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.

`sql_query_finished`

Response was received to SQL query.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Human readable error.
`error_code`	Error code (if available).
`query_first_word`	First word of the query (e.g. `SELECT`).
`consistency`	Requested consistency for the query (Cassandra only). Added: 3.0.0
`error_consistency`	Consistency attempted to be used by Cassandra for the failed query (Cassandra only). Added: 3.0.0

`sql_transaction_finished`

SQL transaction was committed or rolled back.

Field List

Field	Description
`duration`	Duration of the event (in microseconds)
`reason_code`	List of reason code strings why the event happened. See event reasons for possible values.
`error`	Human readable error.
`error_code`	Error code (if available).

Event Categories

Category	Description	Category Type
`auth`	Authentication (server mainly)	`root`
`auth-client`	Authentication client library	`root`
`cassandra`	Cassandra CQL events	`sql`
`dict`	Dictionary library and drivers	`root`
`dict-server`	Dictionary Dictionary server/proxy (dict process)	`root`
`dns`	DNS client library	`root`
`dns-worker`	DNS client library	`root`
`fs`	FS library	`root`
`fts`	fts plugin	`root`
`fts-flatcurve`	fts-flatcurve plugin	`root`
`http-client`	HTTP client library	`root`
`http-server`	HTTP server library	`root`
`imap`	IMAP process	`root`
`imap-hibernate`	imap-hibernate process	`root`
`imap-urlauth`	imap-urlauth process	`root`
`imapc`	imapc storage	`storage`
`lda`	dovecot-lda process	`root`
`lmtp`	LMTP Server process	`root`
`local-delivery`	LDA/LMTP local delivery	`root`
`lua`	Lua script	`root`
`mail-cache`	`dovecot.index.cache` file handling	`root`
`mail-index`	`dovecot.index*` file handling	`root`
`mailbox`	Mailbox (folder)	`storage`
`maildir`	Maildir storage	`storage`
`managesieve`	ManageSieve	`root`
`mbox`	mbox storage	`storage`
`mdbox`	mdbox storage	`storage`
`mysql`	MySQL events	`sql`
`pgsql`	PostgreSQL events	`sql`
`pop3`	POP3 process	`root`
`pop3c`	pop3c storage	`storage`
`push-notification`	push-notification plugin	`root`
`quota-status`	quota-status process	`root`
`sdbox`	sdbox storage	`storage`
`service:<name>`	Named service, e.g. `service:imap` or `service:auth`	`root`
`sieve`	Sieve parent category	`sieve`
`sieve-action`	Individual Sieve actions executed	`sieve`
`sieve-execute`	Sieve script(s) being executed for a particular message; this envelops all of Sieve execution, both runtime and action execution	`sieve`
`sieve-runtime`	Evaluation of individual Sieve scripts	`sieve`
`sieve-storage`	Sieve storage	`sieve`
`smtp-client`	SMTP/LMTP client	`root`
`smtp-server`	SMTP/LMTP server	`root`
`smtp-submit`	SMTP submission client	`root`
`sql`	SQL parent category	`sql`
`sqlite`	SQLite events	`sql`
`sqlpool`	SQL is used internally via "SQL connection pools"	`sql`
`ssl`	SSL/TLS connections	`root`
`ssl-client`	Incoming SSL/TLS connections	`root`
`ssl-server`	Outgoing SSL/TLS connections	`root`
`storage`	Mail storage parent category	`storage`
`submission`	submission server process	`root`

Event Reasons

Reason	Description
`doveadm:cmd_<name>`	Doveadm command is being run.
`fts:index`	Message is being added to the full text search index. Note that this reason won't be used for email opening events, because the emails are already opened by the indexer precache searching code. So usually the `indexer:index_mailbox` reason is what is wanted to be used.
`fts:lookup`	Searching is accessing full text search index.
`imap:cmd_<name>`	IMAP command is being run.
`imap:fetch_body`	A part of the message body is explicitly being fetched. If set, any other `imap:fetch_*` reasons aren't set since this alone is a reason for opening the mail.
`imap:fetch_bodystructure`	IMAP BODY / BODYSTRUCTURE is being fetched. These should normally come from cache.
`imap:fetch_header`	The full header (except maybe some listed headers) are being fetched. If set, any other `imap:fetch_*` reasons aren't set since this alone is a reason for opening the mail.
`imap:fetch_header_fields`	Specific header fields are being fetched. These should normally come from cache.
`imap:fetch_size`	RFC822.SIZE is being fetched. This should normally come from cache.
`imap:notify_update`	The active NOTIFY command is sending updates to client.
`imap:unhibernate`	IMAP client is being unhibernated.
`indexer:index_mailbox`	Mailbox is being indexed.
`lazy_expunge:expunge`	lazy_expunge plugin is handling an expunge. Use for checking the refcount and for actually doing the lazy_expunge move.
`lmtp:cmd_data`	DATA command is being run.
`lmtp:cmd_mail`	MAIL command is being run.
`lmtp:cmd_rcpt`	RCPT command is being run.
`mail:attachment_keywords`	`$HasAttachment` or `$HasNoAttachment` keyword is being generated. Only emitted when a mail body is opened (not when read from cache).
`mail:date`	Date header. Only emitted when a mail body is opened (not when read from cache).
`mail:header_fields`	A specified list of headers. These are normally expected to be returned from cache. Only emitted when a mail body is opened (not when read from cache).
`mail:imap_bodystructure`	IMAP BODY / BODYSTRUCTURE Only emitted when a mail body is opened (not when read from cache).
`mail:imap_envelope`	IMAP ENVELOPE Only emitted when a mail body is opened (not when read from cache).
`mail:mime_parts`	MIME part structure. Only emitted when a mail body is opened (not when read from cache).
`mail:snippet`	Message snippet / IMAP PREVIEW The other reasons may give further details why. Only emitted when a mail body is opened (not when read from cache).
`mailbox:create`	Mailbox is being created
`mailbox:delete`	Mailbox is being deleted
`mailbox:rename`	Mailbox is being renamed
`mailbox:sort`	Mails are being sorted (IMAP SORT)
`mailbox:subscribe`	Mailbox is being subscribed
`mailbox:thread`	Threading is being built for mails (IMAP THREAD)
`mailbox:unsubscribe`	Mailbox is being unsubscribed
`mailbox:update`	Mailbox metadata is being updated (e.g. `doveadm mailbox update`)
`mailbox:vsize`	Mailbox vsize is requested or updated
`mdbox:rebuild`	mdbox storage is being rebuilt
`metacache:flush_all_changed`	All the changes in metacache are being uploaded due to `doveadm metacache flushall`
`metacache:flush_all_important`	All the important changes in metacache are being uploaded due to `doveadm metacache flushall -i`
`metacache:flush_bg_important`	Important changes for a user in metacache are being uploaded due to background uploader
`metacache:upload_all`	All metacache changes are being uploaded
`metacache:upload_important`	Important metacache changes are being uploaded
`metacache:upload_mailbox`	Mailbox's metacache is being uploaded
`metacache:upload_root`	User's root metacache is being uploaded
`metacache_worker:cmd_<name>`	metacache-worker is running a command
`obox:mail_metadata_<name>`	Mail metadata with specified name requested
`obox:mail_metadata_fill`	Filling metadata after mail stream was read; this shouldn't cause any additional IO
`obox:mailbox_rebuild`	Mailbox index is being rebuilt when opening
`obox:mailbox_rescan`	Mailbox is being rescanned when opening
`obox:mailbox_uids_non_reproducible`	Mailbox index bundle is being uploaded to make sure UIDs don't change unexpectedly
`pop3:cmd_<name>`	POP3 command is being run.
`pop3:initialize`	POP3 mailbox is being opened.
`pop3_migration:uidl_sync`	pop3_migration plugin matching IMAP and POP3 mails.
`quota:count`	quota plugin is counting the mailbox's full size. This is normal with `quota=count` driver.
`quota:recalculate`	Quota is being recalculated (e.g. `doveadm quota recalc`)
`storage:autoexpunge`	Mails are being autoexpunged
`storage:mailbox_list_rebuild`	Mailbox list index is being rebuilt
`submission:cmd_data`	DATA command is being run.
`submission:cmd_mail`	MAIL command is being run.
`submission:cmd_rcpt`	RCPT command is being run.
`trash:clean`	trash plugin cleaning space
`virtual:config_read`	virtual plugin mailbox configuration is being read. This may cause mailbox metadata to be accessed.

Databases

Mechanisms

Formats

Extensions

All Dovecot Events ​

Events ​

auth_client_passdb_lookup_finished

auth_client_passdb_lookup_started

auth_client_request_challenged

auth_client_request_continued

auth_client_request_finished

auth_client_request_started

auth_client_userdb_list_finished

auth_client_userdb_list_started

auth_client_userdb_lookup_finished

auth_client_userdb_lookup_started

auth_master_client_login_finished

auth_master_client_login_started

auth_passdb_request_finished

auth_passdb_request_started

auth_policy_request_finished

auth_request_finished

auth_userdb_request_finished

auth_userdb_request_started

client_connection_connected

client_connection_disconnected

cluster_user_group_move_finished

cluster_user_group_move_started

cluster_user_move_finished

cluster_user_move_started

dict_created

dict_destroyed

dict_iteration_finished

dict_lookup_finished

dict_server_iteration_finished

dict_server_lookup_finished

dict_server_transaction_finished

dict_transaction_finished

dns_request_finished

dns_request_started

dns_worker_request_finished

dns_worker_request_started

fs

fs_dictmap_dict_write_uncertain

fs_dictmap_empty_bucket_iterated

fs_dictmap_max_bucket_changed

fs_dictmap_object_lost

fs_file

fs_iter

fs_object_write_uncertain

fts_dovecot_too_many_triplets

http_request_finished

http_request_redirected

http_request_retried

http_server_request_finished

http_server_request_started

imap_client_hibernated

imap_client_unhibernate_retried

imap_client_unhibernated

imap_command_finished

imap_id_received

indexer_worker_indexing_finished

login_aborted

mail_cache_corrupted

mail_cache_decision_changed

mail_cache_decision_rejected

mail_cache_purge_drop_field

mail_cache_purge_finished

mail_cache_purge_started

mail_cache_record_corrupted

mail_delivery_finished

mail_delivery_started

mail_expunge_requested

mail_expunged

mail_index_recreated

mail_metadata_accessed

mail_opened

mail_user_session_finished

managesieve_command_finished

message_hashing_msg_full

All Dovecot Events

Events

`auth_client_passdb_lookup_finished`

`auth_client_passdb_lookup_started`

`auth_client_request_challenged`

`auth_client_request_continued`

`auth_client_request_finished`

`auth_client_request_started`

`auth_client_userdb_list_finished`

`auth_client_userdb_list_started`

`auth_client_userdb_lookup_finished`

`auth_client_userdb_lookup_started`

`auth_master_client_login_finished`

`auth_master_client_login_started`

`auth_passdb_request_finished`

`auth_passdb_request_started`

`auth_policy_request_finished`

`auth_request_finished`

`auth_userdb_request_finished`

`auth_userdb_request_started`

`client_connection_connected`

`client_connection_disconnected`

`cluster_user_group_move_finished`

`cluster_user_group_move_started`

`cluster_user_move_finished`

`cluster_user_move_started`

`dict_created`

`dict_destroyed`

`dict_iteration_finished`

`dict_lookup_finished`

`dict_server_iteration_finished`

`dict_server_lookup_finished`

`dict_server_transaction_finished`

`dict_transaction_finished`

`dns_request_finished`

`dns_request_started`

`dns_worker_request_finished`

`dns_worker_request_started`

`fs`

`fs_dictmap_dict_write_uncertain`

`fs_dictmap_empty_bucket_iterated`

`fs_dictmap_max_bucket_changed`

`fs_dictmap_object_lost`

`fs_file`

`fs_iter`

`fs_object_write_uncertain`

`fts_dovecot_too_many_triplets`

`http_request_finished`

`http_request_redirected`

`http_request_retried`

`http_server_request_finished`

`http_server_request_started`

`imap_client_hibernated`

`imap_client_unhibernate_retried`

`imap_client_unhibernated`

`imap_command_finished`

`imap_id_received`

`indexer_worker_indexing_finished`

`login_aborted`

`mail_cache_corrupted`

`mail_cache_decision_changed`

`mail_cache_decision_rejected`

`mail_cache_purge_drop_field`

`mail_cache_purge_finished`

`mail_cache_purge_started`

`mail_cache_record_corrupted`

`mail_delivery_finished`

`mail_delivery_started`

`mail_expunge_requested`

`mail_expunged`

`mail_index_recreated`

`mail_metadata_accessed`

`mail_opened`

`mail_user_session_finished`

`managesieve_command_finished`

`message_hashing_msg_full`

`message_hashing_msg_part`

`metacache_mailbox_bundle_download_finished`

`metacache_mailbox_bundle_download_started`

`metacache_mailbox_bundle_upload_finished`