How to activate dovecot plugin log delete mail


Today I need to see in log file who delete mails.

First we activate plugins mail_log in dovecot
Edit: vim /etc/dovecot/conf.d/20-imap.conf

# Host allowed in URLAUTH URLs sent by client. "*" allows all.
#imap_urlauth_host =

protocol imap {
# Space separated list of plugins to load (default is global mail_plugins).
#mail_plugins = $mail_plugins
mail_plugins = $mail_plugins mail_log notify

# Maximum number of IMAP connections allowed for a user from each IP address.
# NOTE: The username is compared case-sensitively.
#mail_max_userip_connections = 10
mail_max_userip_connections = 100

And we add mail_plugins = $mail_plugins mail_log notify

Next we will edit : vim /etc/dovecot/conf.d/10-logging.conf

# mail_log plugin provides more event logging for mail processes.
plugin {
# Events to log. Also available: flag_change append
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
# Available fields: uid, box, msgid, from, subject, size, vsize, flags
# size and vsize are available only for expunge and copy events.
mail_log_fields = uid box msgid size

to show like this.

Last step restart dovecot.

systemctl restart dovecot

Check if you get any error, in log file you will see someting like this:

Nov 10 11:25:48 imap( Info: delete: box=Deleted Messages, uid=1252, msgid=<008301d22aa0$53e164e0$fba42ea0$@futuracar>, size=11817
Nov 10 11:25:48 imap( Info: delete: box=Deleted Messages, uid=1253, msgid=<01fc01d22f6f$4b3c15f0$e1b441d0$@futuracar>, size=11402
Nov 10 11:25:48 imap( Info: delete: box=Deleted Messages, uid=1254, msgid=<01f201d23112$579c7750$06d565f0$@futuracar>, size=11396

We make this change in Centos 7.2