Store Transaction Log Format

From Messaging Server Technical Reference Wiki
Revision as of 07:51, 28 August 2017 by BulkPageCreator (Talk | contribs)

Jump to: navigation, search


Message store XML transaction logging is enabled by setting the messagetrace.activate option to transactlog. Both the MTA and store have legacy transaction log formats that are deprecated in favor of the XML format. For a discussion of the MTA XML logging format, see the log_format MTA option.

Each log entry is a self-closing XML entity with a two-letter entity name that contains attributes (also with two-letter names). New attributes may be added and the attributes may be re-ordered in any patch release, so use of an XML-aware parser is recommended. The content of the log is intended to be extended in a backwards-compatible format (with possible exceptions for a major release), unlike the legacy store messagetrace and server log formats which are unstable. Due to the size of transaction log files on busy systems, use of a SAX-style parser is recommended.

To control what actions are logged, use the actions option (unified configuration only). To control what attributes are logged, use the actionattributes option. Note that the MTA uses a different mechanism to control what is logged; see the Transaction logging MTA options section.

XML Log Attributes Always Present in Store Transaction log

The following attributes appear on all Store Transaction Log entries and are thus not mentioned in the event-specific descriptions below:

  • pi - Process id (integer). Note that the MTA uses a different format for this attribute documented in the log_process option.
  • sn - service name (e.g., imap, pop, imquotacheck)
  • ts - time stamp. Both MTA & store use ISO 8601 format as of 8.0.2; but in 8.0 the store used a legacy timestamp format.

XML Log Common Attributes

The following attributes may appear on several XML log entry event types with largely consistent meaning. When these are mentioned in the 'Common' attribute list for an event type, they will be included unless disabled by the actionattributes option.

  • ma - IMAP Mailbox name (internal form)
  • mi - Message id
  • si - session id (IMAP & POP): a unique integer identifier for a client session/connection.
  • tr - transport information (MTA & store). Prior to 8.0.2, the store only included the client's address and port in this field.
  • us - User name: the canonial authorization user identity (the permanent identity of the primary mail account being accessed). For more information on user identifiers see User Identifiers. Can also be [unauthenticated] when appropriate. For the ac action, the string "Admin" is used when this can't be determined (typically for mboxutil).

XML Log Entity Names and Specific Attributes:

ac - Access Control Change (IMAP only). Attributes include:

  • Common: ma, si, us
  • ao - Old ACL using permanent user identifiers. New in 8.0.2.
  • an - New ACL using permanent user identifiers. New in 8.0.2.
  • nt - Old and new ACL with ':' delimiter (Messaging Server 8.0.x only).

co - Socket Connection (open/close). Attributes include:

  • Common: si, tr
  • ac - Action code. First letter is 'O' for connection open and 'C' for connection close. Subsequent letters are extensible flags. See MTA transaction log entry format for the meaning of the subsequent flags for the MTA.
  • at - Store only: will be 'ssl' if SSL was used at connection open time or empty string if SSL was not used.
  • br - bytes received during connection (new in MS 8.0.2).
  • bs - bytes sent during connection (new in MS 8.0.2).
  • nm - number of mailboxes selected during session (new in MS 8.0.2).
  • nt - In 8.0, contains unstructured information about the connection at connection close. Removed in MS 8.0.2 in favor of separate attributes.
  • sd - Session duration with HHH:MM:SS format (new in MS 8.0.2).

ex - Expunge Action (store IMAP expunge/expire). Attributes include:

  • Common: ma, mi, si
  • mc - Messages in mailbox (post-expunge). Prior to MS 8.0.2 this attribute combined me with the pre-expunge message count using a '/' delimiter.
  • me - Messages expunged. New in MS 8.0.2.
  • mi - Message Id. Note that when this attribute is enabled, a separate expunge log entry is created for each message. If this attribute is not enabled, then only one expunge entry is created for each expunge operation.
  • no - Node name (local host name or remote client IP & port).

fe - Fetch Message Action (POP & IMAP only). Attributes include:

  • Common: ma, mi, si, us
  • fd - Fetch decoding (b64, qp or omitted) (9.x IMAP only)
  • fo - Offset to message part in stored message (9.x IMAP only)
  • fp - Fetch offset into message part (9.x IMAP only)
  • om - Alternate for ma code (8.x POP only)
  • sz - Actual bytes fetched. For 9.x this is a number. For 8.x, this instead contains a string combining: fetch start offset ":" fetch data size or "Binary:" followed by the offset into the message, the offset into the decoded data and the fetch data size (IMAP only).
  • ui - IMAP UID for message (9.x IMAP only)

li - Login/Authenticate Action (store). Attributes include:

  • Common: si, tr, us
  • at - Authentication Type (SASL mechanism name, ssl-port-cert, anonymous or plaintext)
  • cs - Ciphersuite used followed by TLS version. If SSL/TLS is not used, this will be 'noSSL'.
  • nt - Authentication Reply
  • ua - User authentication identity. This is the user whose password is used to authenticate; which differs from us when administrative proxy authentication is used (new in MS 8.0.2).

lo - Logout action; (POP-only, only if poplogmboxstat is set). Attributes include:

  • Common: si, tr, us
  • ct - Unix timestamp of POP login.
  • mc - Number of messages not marked for deletion.
  • sz - Total bytes in messages not marked for deletion.

ma - Message Append Action. Attributes include:

  • Common: ma, mi, si, us
  • cx - alternate name for session identifier (MS 8.x only).
  • sz - Total bytes in the appended message.
  • ui - IMAP UID for message
  • uv - IMAP UIDVALIDITY for message

mc, md, mr - Mailbox Create, Delete, Rename Actions (IMAP only). Attributes include:

  • Common: ma, si, us
  • fi - partition name (classic store only)
  • om - rename source (old) IMAP mailbox name (internal form)

ms, mu - Mailbox Subscribe, Unsubscribe Actions (IMAP only). Attributes include:

  • Common: ma, si, us
  • fi - namespace (IMAP2bis only)

qc - Quota Change (IMAP only). Attributes include:

  • Common: si, us
  • ur - Quota Root
  • dq - Disk storage quota (number in KB)

qe - Quota Exceeded Action (quotacheck tool only). Attributes include:

  • Common: us
  • dq - Disk storage quota (number in KB)
  • du - Disk storage usage (number in KB)
  • mq - Message count quota (number)
  • mc - Message count used (number)
  • qt - Overquota Trigger (numeric percentage)
  • qr - Quota Rule Name ('General' if not using a rule file)

sl - Select Mailbox (IMAP only). Attributes include:

  • Common: ma, si, tr, us


See also: