Audit Log API

Structured audit logging API.

This API provides functions for writing logfmt log events to syslog. Each function logs a specific kind of event with associated data (mailbox info, message IDs, user info, etc.).

Functions

void auditlog_acl(const char *mboxname, const mbentry_t *oldmbentry, const mbentry_t *mbentry)

Log an ACL change on a mailbox.

void auditlog_client(const char *action, const char *userid, const char *client)

Log a client connection.

void auditlog_duplicate(const char *action, const duplicate_key_t *dkey)

Log a duplicate delivery check or suppression.

void auditlog_imip(const char *message_id, const char *outcome, const char *errstr)

Log the result of Sieve processimip action.

void auditlog_mailbox(const char *action, const struct mailbox *oldmailbox, const struct mailbox *mailbox, const char *newpartition)

Log an action on a mailbox (passed by struct)

void auditlog_mboxname(const char *action, const char *userid, const char *mboxname)

Log an action on a mailbox (referenced by name)

void auditlog_message(const char *action, struct mailbox *mailbox, const struct index_record *oldrecord, const struct index_record *record, const char *message_id)

Log an action taken on an individual message (passed by struct)

void auditlog_message_uid(const char *action, const struct mailbox *mailbox, uint32_t uid, const char *flagstr)

Log an action taken on an individual message (referenced by uid)

void auditlog_modseq(const struct mailbox *mailbox)

Log mailbox modseq state.

void auditlog_proxy(const char *userid, const char *status)

Log a proxy connection to a backend server.

void auditlog_quota(const char *action, const char *root, const quota_t *oldquotas, const quota_t *newquotas)

Log a quota change.

void auditlog_sieve(const char *action, const char *userid, const char *in_msgid, const char *out_msgid, const char *target, const char *vac_from_addr, const char *vac_to_addr)

Log a Sieve filter action (fileinto, redirect, vacation, etc.)

void auditlog_send(const struct auditlog_send_event *s)

Log a calalarmd send with scheduled-vs-actual delay.

void auditlog_traffic(uint64_t bytes_in, uint64_t bytes_out)

Log session traffic statistics.

struct auditlog_send_event
#include <auditlog.h>

A calalarmd send event, for auditlog_send()

Public Members

const char *action
const char *outcome
const char *userid
time_t scheduled
time_t sent
const char *msgid
const char *from
const char *to
const char *subject
const char *caluid
unsigned num_rcpts
unsigned num_retries