Email Traffic Log
A structured record of every message the mail system handled, for the whole server. Each account holder sees their own share of the same records in their panel; this screen has all of them, with the account behind each.
The record itself is explained in the account docs: what a row holds, the hops, the authentication results, the spam score. What differs for you is finding a message across accounts, where the records come from, and retention.
The screen
System › Email Traffic Log lists the records newest first, with the sender, the recipients, the time and the size. A record's page shows everything the account holder's does, plus Parties: the accounts involved in the delivery, linked to their pages.
Filter narrows the list:
| Filter | Takes |
|---|---|
| Type | One of the types below. |
| From, To | A time range. |
| Sender | A sender address, or part of one. |
| IP Address | One address or a CIDR network, e.g. 192.168.1.0/24. |
Lookup opens one record directly from its Delivery ID or Queue ID.
| Type | What it is |
|---|---|
| Incoming email | Mail from outside, received for a hosted address. |
| Outgoing email | Mail a mailbox or send-only user submitted for sending. |
| Local forwarding | A forwarder or a group passing mail on. |
| Application-generated email | Mail an account's programs sent through sendmail. |
| Email that a mailbox started | Mail the system generates for a mailbox. |
| Mailing list post | A post arriving at a mailing list, and the copies sent to its members. |
| Mailing list administrative email | A mailing list's own messages, e.g. a confirmation. |
Trace one message
Every message has two identifiers:
- the queue ID the mail system logs for it, which also appears on the Outgoing Mail Queue while the message waits; a message's page there has Open in the traffic log;
- the delivery ID, the record's own UUID in the panel.
Paste either into Lookup. For a message an account holder asks about, the account docs explain how to read the identifiers out of its headers.
The mail system reuses queue IDs. Lookup opens the newest record with that ID; an old mail log line can name an ID that now belongs to another message.
Two sections of a record tell you what happened after the server accepted the message:
| Section | Source |
|---|---|
| Delivery Attempts | One row per recipient per attempt, from the outgoing mail system's log: deferred with the reason, sent, bounced, or expired. |
| Deferral | The recipients still deferred right now, read from the mail queue when you open the page. Empty once the message has left the queue. |
Where the records come from
The panel never reads the mail log itself. Two uploaders on the server feed it:
- A milter in the mail system writes one record per message at the end of the data, and an uploader posts it to the panel. The record's UUID is the key: a record posted twice is stored once, so a replayed upload is harmless.
- A log follower reports each delivery attempt as the mail system logs it. Attempts are matched to the record by queue ID when you open the page, not when they arrive, so an attempt can be recorded before its message's record is, and the page shows both as soon as both are there.
A record that the panel refused as unprocessable, or couldn't take while it was unavailable, is kept by the uploader in its failed spool and isn't in this log until it is replayed.
Retention
Records, their delivery attempts and the rejected-mail records are kept 100 days and purged nightly; Housekeeping lists the three commands and their schedules. To purge earlier by hand:
elpanctl housekeeping:maildelivery:purge --before="-30 days"
Mail the server refused before it was queued leaves no delivery record. A script's message that the sender check or the spam filter refused is on the account's Sendmail Failures page instead (account docs).