Events

List of all events that can be used in Statistics and elsewhere.

Note

In v2.3 these are added on version basis, so not all events are available in all v2.3 releases.

Authentication Server

New in version v2.3.7.

These events are generated by authentication in auth process(es).

auth_request_finished

  • user: full username
  • original_username: original username used
  • translated_username: username after translations
  • login_user: when doing login using master_user, this is the user we are logging in as
  • master_user: master username
  • error: set when error happens
  • success: yes, when succeeded
  • transport: insecure, trusted, TLS
  • mechanism: name of used mechanism
  • credentials_scheme: type of credential (SHA256-CRYPT, PLAIN, …)
  • policy_penalty: time of penalty added by policy server
  • policy_result: ok, delayed, refused

auth_passdb_request_started

  • passdb_id: ID number of the passdb (0..n) (v2.3.9+)
  • passdb_name: passdb { name } if it is configured, otherwise the driver name.
  • passdb: driver

auth_passdb_request_finished

  • passdb_id: ID number of the passdb (0..n) (v2.3.9+)
  • passdb_name: passdb { name } if it is configured, otherwise the driver name.
  • passdb: driver
  • user: full username
  • master_user: master user name
  • username: username without domain
  • domain: domain if present
  • result: authentication result: ok, password_mismatch, user_unknown, pass_expired, user_disabled, scheme_not_available, internal_failure, next

auth_userdb_request_started

  • userdb_id: ID number of the userdb (0..n) (v2.3.9+)
  • userdb_name: userdb { name } if it is configured, otherwise the driver name.
  • userdb: driver

auth_userdb_request_finished

  • userdb_id: ID number of the userdb (0..n) (v2.3.9+)
  • userdb_name: userdb { name } if it is configured, otherwise the driver name.
  • userdb: driver
  • user: full username
  • master_user: master user name
  • username: username without domain
  • domain: domain if present
  • result: authentication result: ok, user_unknown, internal_failure

auth_policy_request_finished

  • mode: allow, report
  • policy_response: number

Authentication Client

New in version v2.3.7.

These events are generated by authentication clients (lib-auth).

auth_client_request_started

  • id: event id

auth_client_request_continue

  • id: event id

auth_client_request_finished

  • id: event id
  • error: reason

auth_client_request_challenged

  • id: event id

auth_client_userdb_lookup_started

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username

auth_client_userdb_lookup_finished

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username
  • error: error if occured

auth_client_passdb_lookup_started

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username

auth_client_passdb_lookup_finished

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username
  • error: error if occured

auth_client_userdb_list_started

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username

auth_client_userdb_list_finished

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username
  • error: error if occured

auth_client_cache_flush_started

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username

auth_client_cache_flush_finished

  • service: name of service (smtp, imap, lmtp…)
  • local_ip: local ip
  • local_port: local port
  • remote_ip: remote ip
  • remote_port: remote port
  • user: full username
  • error: error if occured

Connection

These events apply only for connections using the connection API. Unfortunately not all connections currently use this, so these events work for some types of connections, but not for others.

client_connection_connected

  • client_ip: source IP
  • client_port: source port
  • ip: target IP
  • port: target port

client_connection_disconnected

  • fields from client_connection_connected
  • bytes_in: amount of data read
  • bytes_out: amount of data written
  • reason: disconnection reason

server_connection_connected

  • client_ip: source IP
  • client_port: source port
  • ip: target IP
  • port: target port
  • bytes_in: amount of data read
  • bytes_out: amount of data written

server_connection_disconnected

  • fields from server_connection_connected
  • bytes_in: amount of data read
  • bytes_out: amount of data written
  • reason: disconnection reason

HTTP

http_request_finished

  • status_code: HTTP result status code
  • attempts: Number of individual HTTP request attempts that were done (i.e. number of retries after failures + 1)
  • redirects: Number of redirects that were done while processing this request.
  • bytes_in, bytes_out: Number of bytes received/sent for this request.

http_request_redirected

  • Intermediate event sent while HTTP request is being redirected. The http_request_finished is still being sent as well.
  • Same fields as http_request_finished

http_request_retried

  • Intermediate event sent while HTTP request is being retried. The http_request_finished is still being sent as well.
  • Same fields as http_request_finished

IMAP

imap_command_finished

Note

These are currently not sent for pre-login IMAP commands.

  • tag: Command tag
  • name: Command name
  • args: Command’s full parameters
  • human_args: Command’s parameters as more human-readable output
  • tagged_reply_state: OK, NO, BAD
  • tagged_reply: Full tagged reply, e.g. “OK SELECT finished.”
  • last_run_time: Timestamp when the command was running last time (it’s followed by “mailbox sync” that can take some time)
  • running_usecs: How many usecs this command itself has spent running
  • lock_wait_usecs: How many usecs this command itself has spent waiting for locks.
  • bytes_in, bytes_out: How many bytes of client input/output command has used.

Mail Delivery

New in version 2.3.8.

mail_delivery_started

  • message_id: Message-ID header’s value truncated to 200 bytes
  • message_subject: Subject in UTF-8 and truncated to 80 bytes
  • message_from: Email address in the From field (e.g. “user@example.com”)
  • message_size: Size of the message
  • message_vsize: Size of the message with CRLF linefeeds
  • rcpt_to: The envelope recipient for the delivered message message.
  • rcpt_param_notify: only: The value of the NOTIFY parameter for the LMTP RCPT command.
  • rcpt_param_orcpt: The address value of the ORCPT parameter for the LMTP RCPT command.
  • rcpt_param_orcpt_type: The address type (typically “rfc822”) of the ORCPT parameter for the LMTP RCPT command.

mail_delivery_finished

  • Same fields as mail_delivery_started

DNS

dns_worker_request_finished and dns_request_finished

  • error: Human readable error
  • error_code: Error code usable with net_gethosterror()

dns_worker_request_started and dns_request_started

SQL

sql_query_finished

  • error: Human readable error
  • error_code: Error code (if available)
  • query_first_word: First word of the query, such as SELECT

sql_transaction_finished

  • error: Human readable error
  • error_code: Error code (if available)

sql_connection_finished