When was mail account last accessed?

Hello, is there a way to check when a user last accessed his mail? And the IP he came from?

Thank you

You can find that information in the email log, either /var/log/maillog or /var/log/mail.log.


Ok Eric, thank you.

It would be nice to have this information on the Mail and FTP users list. I have a domain with 150 users, and the client is asking for that information. It will be a lot of work to get that info from mail.log.

Best regards

It’s not too much work – if you want to know the last 10 times a user logged in via IMAP, you can just type this:

grep USERNAME /var/log/mail.log | grep -i imap | tail -10

That’ll give you 10 lines like this:

Jun 25 10:33:56 core dovecot: imap-login: Login: user=, method=PLAIN, rip=x.y.z.q, lip=x.y.z.q, secured

Also, poking around a bit, I see that there’s an option in Virtualmin to search the mail logs – it’s in Logs and Reports -> Search Mail logs.


Hello Eric, yes, I can do that, but I still think it would be better to have that info on the virtualmin interface, or an automated way of doing it.
The way it is, I’ll have to use grep command 150 times, one for each user, right?
Thank you very much for your help.

  • Rogerio

If you want to add this to the Virtualmin UI, the best way might be as a plugin that adds fields to the Edit Mailbox form. This assumes you know some perl though…

I’d be reluctant to implement this as a standard feature though, as it could get really slow if the mail log is large … and I haven’t heard anyone request this before.

Thanks Jamie.

Maybe there is another way to do what I need. Let me try to explain it. My virtualmin server acts as secondary mail server for one of my clientes (MX with lower priority). My client’s main mail server pulls all the messages for all the accounts in a 5 minutes interval, and some messages didn’t get delivered. So my client asked me to check if all the accounts were being pulled, and if there were any failed logins caused by wrong passwords. How can I easily get that information? My client has 150 accounts in his domain.

I have another server running Communigate Pro. On that server, one client was complaining he was not getting any mail in one particular account. The Communigate interface gives me the last time an account was accessed, and the IP it came from, on the account list. It was very fast and easy to see it that client didn’t access his account for over a month. The problem was the configuration on his Outlook. It would take me longer to identify the problem without the “last access” info.

But I guess that’s not easy to implement, because for it to be efficient the “last access” info should be stored somewhere when it happens, and not retrieved from the mail.log.

Thank you

Yes, the problem is that Dovecot does not store the last access time anyway, so it would have to be extracted from the mail logs.

By the way, in your secondary mail server setup, are you using SMTP to delivery to the primary mail server, or is it pulling in email via IMAP or POP3? Using SMTP is much better, if possible…

Hi Jamie.

I’m using POP to retrieve the messsages. How do I configure a domain to push all messages to another server using SMTP? That would be much better.

Thank you


Assuming that the other server can accept SMTP connections for the domain, this can be configured using the Mail Relaying plugin for Virtualmin. For documentation on installing and using it, see :


Great info Jamie.

Thank you very much.