Store Transaction Log Format

From Messaging Server Technical Reference Wiki
Revision as of 09:11, 12 January 2017 by BulkPageCreator (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search


Message store XML transaction logging is enabled by setting the messagetrace.activate option to transactlog. Both the MTA and store have legacy transaction log formats that are deprecated in favor of the XML format. For a discussion of the MTA XML logging format, see the log_format MTA option.

Each log entry is a self-closing XML entity with a two-letter entity name that contains attributes (also with two-letter names). New attributes may be added and the attributes may be re-ordered in any patch release, so use of an XML-aware parser is recommended. The content of the log is intended to be extended in a backwards-compatible format (with possible exceptions for a major release), unlike the legacy store messagetrace and server log formats which are unstable. Due to the size of transaction log files on busy systems, use of a SAX-style parser is recommended.

To control what actions are logged, use the actions option (unified configuration only). To control what attributes are logged, use the actionattributes option. Note that the MTA uses a different mechanism to control what is logged; see the Transaction logging MTA options section.

XML Log Attributes Always Present in Store Transaction log

The following attributes appear on all Store Transaction Log entries and are thus not mentioned in the event-specific descriptions below:

  • pi - Process id (integer). Note that the MTA uses a different format for this attribute documented in the log_process option.
  • sn - service name (e.g., imap, pop, imquotacheck)
  • ts - time stamp. Both MTA & store use ISO 8601 format as of 9.0; but in 8.0 the store used a legacy timestamp format.

XML Log Common Attributes

The following attributes may appear on several XML log entry event types with largely consistent meaning. When these are mentioned in the 'Common' attribute list for an event type, they will be included unless disabled by the actionattributes option.

  • ma - IMAP Mailbox name (internal form)
  • mi - Message id
  • si - session id (IMAP & POP): a unique integer identifier for a client session/connection.
  • tr - transport information (MTA & store). Prior to 9.0, the store only included the client's address and port in this field.
  • us - User name: the canonial authorization user identity (the permanent identity of the primary mail account being accessed). For more information on user identifiers see User Identifiers. Can also be [unauthenticated] when appropriate. For the ac action, the string "Admin" is used when this can't be determined (typically for mboxutil).

XML Log Entity Names and Specific Attributes:

ac- Access Control Change (IMAP only). Attributes include:

  • Common: ma, si, us
  • nt - Old and new ACL with ':' delimiter.

co- Socket Connection (open/close). Attributes include:

  • Common: si, ts
  • ac - Action code. First letter is 'O' for connection open and 'C' for connection close. Subsequent letters are extensible flags. See MTA transaction log entry format for the meaning of the subsequent flags for the MTA.
  • at - Store only: will be 'ssl' if SSL was used at connection open time or empty string if SSL was not used.
  • nt - May contain additional unstructured information about the connection at connection close.

ex- Expunge Action (store IMAP expunge/expire). Attributes include:

  • Common: ma, mi, si
  • no - Node name (local host name or remote client IP & port)

fe- Fetch Message Action (POP & IMAP only). Attributes include:

  • Common: ma, mi, si, us
  • sz - Fetch start offset ":" fetch data size (IMAP only)

li- Login/Authenticate Action (store). Attributes include:

  • Common: si, tr
  • at - Authentication Type (SASL mechanism name, ssl-port-cert, anonymous or plaintext)
  • cs - Ciphersuite used followed by TLS version. If SSL/TLS is not used, this will be 'noSSL'.
  • nt - mshttpd session id string (mshttpd only)

lo- Logout action; deprecated in favor of co; (POP-only). Attributes include:

  • Common: si, tr, us
  • ct - Unix timestamp of POP login.
  • mc - Number of messages not marked for deletion.
  • sz - Total bytes in messages not marked for deletion.

ma- Message Append Action (IMAP append only). Attributes include:

  • Common: ma, mi, si, us
  • sz - Total bytes in the appended message.
  • ui - IMAP UID for message
  • uv - IMAP UIDVALIDITY for message

mc, md, mr, ms, mu - Mailbox Create, Delete, Rename, Subscribe, Unsubscribe Actions (IMAP only). Attributes include:

  • Common: ma, si, us
  • fi - partition name (classic store only)
  • om - rename source (old) IMAP mailbox name (internal form)

qe- Quota Exceeded Action (quotacheck tool only). Attributes include:

  • Common: us
  • dq - Disk storage quota (number in KB)
  • du - Disk storage usage (number in KB)
  • mq - Message count quota (number)
  • mc - Message count used (number)
  • qt - Overquota Trigger (numeric percentage)
  • qr - Quota Rule Name ('General' if not using a rule file)

sl- Select Mailbox (IMAP only). Attributes include:

  • Common: ma, si, tr, us


See also: