Find, Test and Reopen Dovecot Logs with doveadm log

Mail is misbehaving and you cannot even find where Dovecot writes its logs; doveadm log answers that in one command. You will find the log destinations, read recent warnings, send a recognisable test message, and reopen files after rotation. Allow about ten minutes.

The examples target the installed dovecot-core package, version 1:2.3.21+dfsg1-2ubuntu6.5, providing Dovecot 2.3.21.

• What you need: a shell and a working Dovecot installation.
• Harmless: finding logs and reading status.
• Not harmless: log test writes to the configured logs and log reopen signals the Dovecot master. Run those two only when you intend to affect the running service.
• Privileges: use the account your installation needs, and add sudo only when the command reports a privilege or socket-access problem.

1. Confirm the installed command

Check the package and binary before relying on examples from a different Dovecot release:

$ dpkg-query -W -f='${Package} ${Version}\n' dovecot-core
dovecot-core 1:2.3.21+dfsg1-2ubuntu6.5
$ dovecot --version
2.3.21 (47349e2482)

The package revision and build identifier can differ after updates. The installed Dovecot 2.3 manpage documents the command group used here. Newer Dovecot documentation keeps the same four subcommands, but surrounding configuration and privilege rules may differ on another host.

2. Locate every configured log target

Start with the read-only lookup:

$ doveadm log find
Looking for log files from /var/log
Debug: /var/log/dovecot.debug
Info: /var/log/mail.log
Warning: /var/log/mail.log
Error: /var/log/mail.log
Fatal: /var/log/mail.log

The paths are host-specific. You may see Not found, or several priorities may share one file. Dovecot can log straight to files or through syslog, so an error may not be in the same file as the informational messages.

$ sudo doveadm log find /var/log
Looking for log files from /var/log
Debug: Not found
Info: /var/log/mail.log
Warning: /var/log/mail.log
Error: /var/log/mail.log
Fatal: /var/log/mail.log

Replace /var/log with your actual syslog directory. The argument only tells the lookup where to search. It does not reconfigure Dovecot or create a missing log file.

3. Read the recent Dovecot warnings

Use log errors for Dovecot's recent error and warning records rather than a path listing:

$ sudo doveadm log errors
imap-login: Error: example diagnostic text
pop3-login: Warning: example diagnostic text

The command returns up to 1,000 errors and warnings. If it prints nothing, the manpage reads that as no errors since the last start. Treat that as a narrow result, not proof every historical log file is clean. It does not replace searching rotated files or checking the system journal.

To look at one incident, limit the query to records after a Unix timestamp. Generate the timestamp separately so you can see the value before Dovecot gets it:

$ SINCE=$(date -d '30 minutes ago' +%s)
$ printf 'checking records since %s\n' "$SINCE"
checking records since 1780194600
$ sudo doveadm log errors -s "$SINCE"
imap: Error: example diagnostic text

The printed number is only an example and varies with the clock. The -s value is seconds since the Unix epoch, not a readable date. For a precise window, run the command straight after the timestamp assignment.

4. Test the configured destinations

$ sudo doveadm log test
Debug: This is Dovecot's debug log (timestamp)
Info: This is Dovecot's info log (timestamp)
Warning: This is Dovecot's warning log (timestamp)
Error: This is Dovecot's error log (timestamp)
Fatal: This is Dovecot's fatal log (timestamp)

The literal timestamp and exact formatting depend on the running version. What matters is that messages appear in the destinations reported by log find, with the expected priority labels. A file that stays empty may be the wrong target, a syslog routing issue, a permission problem, or a Dovecot configuration problem.

5. Reopen files after rotation

$ sudo doveadm log reopen
$ printf 'doveadm log reopen status: %s\n' "$?"
doveadm log reopen status: 0

The master reopens the files configured by log_path, info_log_path and debug_log_path, then signals the log process to do the same. It does not rotate, compress or remove files. Those belong to your logrotate or service-management configuration.

For a manual rotation, check that the new file gets a fresh record after reopening:

$ sudo doveadm log reopen
$ sudo doveadm log test
$ sudo tail -n 20 /var/log/dovecot.log

Replace the path with the destination from doveadm log find.

6. Keep configuration and privilege boundaries clear

The global -o setting=value option overrides a Dovecot setting for one invocation, and -D enables debug messages. Both suit controlled diagnostics, but they can make output harder to interpret.

Reading paths may work as an ordinary user, while querying the log-errors socket, sending the test message or signalling the master needs elevated access. Start unprivileged where possible. Use sudo for the individual command when required, then inspect its output and status. A successful privileged command proves the operation ran, not that every log priority is routed correctly.

If your deployment uses /etc/dovecot/conf.d/10-logging.conf, review the effective configuration through your normal process before changing it. The four commands in this guide do not edit that file. Any configuration change needs a service-impact review and a tested rollback, especially when it redirects mail logs to a new filesystem.