My /var/log/mail.log gets constantly flooded with Dovecot connect/disconnect messages like this:

Mar 29 18:15:48 summit dovecot: IMAP([email protected]): Disconnected: Logged out bytes=63/2126          
Mar 29 18:15:50 summit dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=, lip=, TLS

These are repeated ad infinitum (to the tune of 11MB of logs per day), and they're obscuring the more important authentication failures and Postfix deliveries/receptions. I've checked Dovecot's wiki page for logging, but no option there stops these messages. Is there any configuration variable I can set within dovecot.conf to stop these messages being sent to mail.log?

Clarification: I still want Dovecot to log to mail.log; I just don't want it logging these frivolous connect/disconnect messages.

  • I know this is old but may help others. The connect/disconnect info's are not frivolous - they are info - block as needed. Also, if you are letting your user(s) connect using a 'webmail' type system, they normally have a frontend option. Default can be a 'check' once per minute. Whereas a proper email client like Thunderbird does not - just when mail arrives or operation from enduser/client is executed.
    – B. Shea
    Mar 1, 2016 at 22:35
  • ..u may get a login if not connected..
    – B. Shea
    Mar 1, 2016 at 22:52

6 Answers 6


If you are using rsyslog or syslog-ng you can filter syslog messages. Here is an example from the rsyslog help:

with a simple statement:

:msg, contains, "imap-login" ~

or with the if-else script language:

if $programname == 'dovecot' then {
   action(type="omfile" file="/var/log/dovecot.log")
   if $msg contains 'imap-login' then
     action(type="omfile" file="/var/log/dovecot-login.log")
     action(type="omfile" file="/var/log/dovecot.log")


  • 3
    It's a real shame that Dovecot doesn't have configuration paramaters for this. Dec 2, 2015 at 22:09

Enable Logging to a file with log_path and/or info_log_path then comment out syslog_facility.


Change the syslog_facility and control the output with /etc/syslog.conf.


## Logging

# Log file to use for error messages, instead of sending them to syslog.
# /dev/stderr can be used to log into stderr.
#log_path = /var/log/dovecot.log

# Log file to use for informational and debug messages.
# Default is the same as log_path.
#info_log_path = /var/log/dovecot-info.log


# Syslog facility to use if you're logging to syslog. Usually if you don't
# want to use "mail", you'll use local0..local7. Also other standard
# facilities are supported.
syslog_facility = mail

  • I think I may have not been clear enough in my question. I still want Dovecot to log to mail.log, but I don't want it to display these frivolous imap-login messages. Thanks for your help though!
    – squircle
    Mar 30, 2011 at 0:51

The easiest way I could get rid of dovecot's login/logout messages was by creating the file 49-dovecot-ignore-info.conf under /etc/rsyslog.d with:

mail.=info       ~

This basically means to discard all info messages comming from mail facility (which dovecot uses). More info: http://manpages.ubuntu.com/manpages/hardy/man5/rsyslog.conf.5.html, under Discard section.

Then do a

sudo service dovecot restart

And the messages are no long stored in log files.

  • I don't agree with this solution because it trashes all mail.info messages, most of which are important (like those coming from $mta (postfix in my case)).
    – squircle
    Dec 25, 2012 at 18:32

First remove syslog from dovecot has it's critical to have syslog clean as dovecot produce a lot of log so log it separately (rsyslog) is your friend to make your log rotate.

If you use dovecot with multi files configuration (debian) just go to 10-logging.... Don t forget to make a check with grep log *.conf on all configuration files to be sure that nothing is write two or more times. Then because your processor and your hard drive are precious just put that.

One day if you need to have informations just comment this line and log this somewhere else.

info_log_path = /dev/null


"connect/disconnect" messages are info messages from dovecot, so you can configure dovecot not to log the info messages:

# /etc/dovecot/conf.d/10-logging.conf
info_log_path = /dev/null

# same for debug messages
debug_log_path = /dev/null

# if you set a file path, it will log to this file and not to syslog anymore
info_log_path = /var/log/mail.log

How about a cron job every hour or so to remove the lines with sed something like this:

sed -e '/\(dovecot: IMAP.*Disconnected:.*\|dovecot: imap-login: Login: user\)/d' /var/log/mail.log > /var/log/mail.log

I am no master or regex or sed so please take a long hard look at this if you want to use it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .