10-logging.conf controls verbosity:
log_path = /var/log/dovecot.log
info_log_path = /var/log/dovecot-info.log
debug_log_path =
login_log_format = "%u: %m"
login_log_format_elements = "user=<%u> method=%m rip=%r lip=%l mpid=%e %c"
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
plugin {
mail_log_fields = uid box msgid size
}
The mail_log plugin (load via mail_plugins = mail_log notify) writes audit lines for destructive events. Critical for compliance (HIPAA, financial services).
Forward to SIEM: use rsyslog or vector to push /var/log/dovecot.log into Loki, Elastic, Splunk. Tag by mpid (mail process ID) to thread events per session.
Track logins from new IPs: combine mail_log with a fail2ban filter or a custom script that emails users when a login arrives from an unrecognized ASN.
Sign in to keep track of what you have read.