Mailcow logs viewer: A faster, cool way to monitor your emails

shlomi · 2025-12-25T18:47:39+00:00

Hi everyone, While mailcow is an amazing suite, I often found the built-in log viewing options a bit clunky when I needed to debug something quickly (its ev...

maybl8

piperino

[demo@mail mailcow-logs-viewer]$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      288614/docker-proxy
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN      288588/docker-proxy
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      288081/docker-proxy
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      288330/docker-proxy
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN      288360/docker-proxy
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      288107/docker-proxy
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      288383/docker-proxy
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN      288665/docker-proxy
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      288640/docker-proxy
tcp        0      0 127.0.0.1:13306         0.0.0.0:*               LISTEN      288296/docker-proxy
tcp        0      0 0.0.0.0:4190            0.0.0.0:*               LISTEN      288704/docker-proxy
tcp        0      0 100.85.253.81:52187     0.0.0.0:*               LISTEN      574/tailscaled
tcp        0      0 127.0.0.1:7654          0.0.0.0:*               LISTEN      288439/docker-proxy
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      8309/crowdsec
tcp        0      0 0.0.0.0:9099            0.0.0.0:*               LISTEN      287652/docker-proxy
tcp        0      0 127.0.0.1:6060          0.0.0.0:*               LISTEN      8309/crowdsec
tcp        0      0 127.0.0.1:5939          0.0.0.0:*               LISTEN      621/teamviewerd
tcp        0      0 127.0.0.1:19991         0.0.0.0:*               LISTEN      288728/docker-proxy
tcp        0      0 127.0.0.1:35447         0.0.0.0:*               LISTEN      582/containerd
tcp6       0      0 :::143                  :::*                    LISTEN      288619/docker-proxy
tcp6       0      0 :::110                  :::*                    LISTEN      288593/docker-proxy
tcp6       0      0 :::80                   :::*                    LISTEN      288089/docker-proxy
tcp6       0      0 :::25                   :::*                    LISTEN      288336/docker-proxy
tcp6       0      0 :::465                  :::*                    LISTEN      288365/docker-proxy
tcp6       0      0 :::443                  :::*                    LISTEN      288117/docker-proxy
tcp6       0      0 :::587                  :::*                    LISTEN      288388/docker-proxy
tcp6       0      0 :::995                  :::*                    LISTEN      288680/docker-proxy
tcp6       0      0 :::993                  :::*                    LISTEN      288645/docker-proxy
tcp6       0      0 :::3000                 :::*                    LISTEN      568/grafana
tcp6       0      0 :::4190                 :::*                    LISTEN      288712/docker-proxy
tcp6       0      0 fd7a:115c:a1e0::2:52663 :::*                    LISTEN      574/tailscaled
tcp6       0      0 :::9099                 :::*                    LISTEN      287658/docker-proxy
tcp6       0      0 :::9090                 :::*                    LISTEN      1/systemd
udp        0      0 0.0.0.0:41641           0.0.0.0:*                           574/tailscaled
udp        0      0 0.0.0.0:34578           0.0.0.0:*                           280644/rustdesk
udp        0      0 0.0.0.0:21119           0.0.0.0:*                           280644/rustdesk
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           506/avahi-daemon: r
udp6       0      0 :::41641                :::*                                574/tailscaled
udp6       0      0 fe80::ea97:8875:2f4:546 :::*                                553/NetworkManager
udp6       0      0 :::5353                 :::*                                506/avahi-daemon: r

piperino

maybl8

tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 8309/crowdsec

port seems to be occupied by “crowdsec”

maybl8

piperino
I didn’t even know it was using that port. My mistake.
I will change the port mailcow logs use and see if that works

[unknown]
That was it thank for all the help.
Sorry for the mistake on my part.

[unknown]
That was it . Thanks for the help.
sorry for the runaround with my mistake.

shlomi

maybl8 0.0.0.0:8080/tcp: address already in use

your running crowdsec on port 8080.
change the port for mailcow-logs-viewer, edit .env file and set

APP_PORT=8090

maybl8

shlomi
After figuring out what my issue was with this running one question I still have is the ip address I need to list in the API screen. Right now I have these.
Do I need all of these:

192.168.68.0/32
75.115.164.173
172.16.0.0/12
172.22.0.0/12

piperino

maybl8

👍️ glad it worked out.

Cisco30

DocFraggle
Hi
That’s true, but in my cluster, all traffic is distributed by HAProxy, even when allowing all IPs on the API. To get Mailcow logs viewer working, port 443 is mandatory… otherwise, there’s no response.
But just like you, I find Shlomi’s work on reading the logs impressive.

rmfausi

Hello at all,

ERROR - Request error for https://mailcow.server.lan/api/v1/get/logs/netfilter/500: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1016)

I only have a self-signed cert on mailcow, is it not possible to connect with it?

Greetings rmfausi

Cisco30

rmfausi
Hi
This has nothing to do with the topic; please create a separate request.

rmfausi

Cisco30
I wan’t to connect to my mailcow server, this is a log entry from the
mailcow-logs-app container. The Software can’t retrieve any logs from the server.

I think this is ontopic here.

Greetings

shlomi

rmfausi
Just a quick question - why not use Let’s Encrypt? It’s free.
In any case, if your setup requires it, I’ll have to add an option to allow connections using self-signed certificates.

Unfortunately, I don’t think I’ll be able to get done it in the next few days.

Cisco30

rmfausi
Sorry, I was thinking it was a problem with the certificate renewal.

[unknown]
https://mailcow.server.lan
What exactly is that address for?

rmfausi

shlomi

Yes, i know it’s free. I’m using let’s encrypt certs for a long time on other servers.
I haven’t seen any current use for it yet; everything has worked without it so far.
I’ve seen your software today’s first time and i want it to check out.
I will setup tomorrow let’s encrypt certs on my mailserver.

Greetings rmfausi

Thanks @[deleted] and @[deleted], it works beautiful, with the let’s encrypt certs. :-)

Greetings rmfausi.

rmfausi

Cisco30 server.lan is the dns-domain for private internal homelab.

Greetings rmfausi

shlomi

This is still a work in progress. here is a small taste

smart

Hi,
happily using it for 10 days now.
still very professional.
no issues at all.

i kindly may suggest to include backup logs.
a) component backups
b) automatically created daily backups
c) borgmatic backups

either a,b or c or all 3 of them if in use.

shlomi

smart
What is backup logs? i dont see it in mailcow

smart

shlomi

oh i guess it’s only available though general logs..
or others command.

for example when i want wo see the borgmatic backup status i use:
docker compose logs -f –tail 200 | grep borgmatic

Result will be something like this:

borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 borgmatic-mailcow-1 | ——————————————————————————
| crond: USER root pid 6504 cmd PATH=$PATH:/usr/local/bin /usr/local/bin/borgmatic –stats -v 0 2>&1
| rsync: Ignoring configured “read_special” value of false, as true is needed for database hooks.
| ——————————————————————————
| Repository: ssh://user@user.your-storagebox.de:23/./backups/mailcow
| Archive name: mailcow-2026-01-07T17:14:26.163078.checkpoint
| Archive fingerprint: 6980477094d1500e02bdxxxx3d4217f4dc8axyxyxb8b0bf535c08bee4d29629
| Time (start): Wed, 2026-01-07 17:14:27
| Time (end): Wed, 2026-01-07 17:15:16
| Duration: 49.00 seconds
| Number of files: 154338
| Utilization of max. archive size: 0%
| ——————————————————————————
| Original size Compressed size Deduplicated size
| This archive: 10.98 GB 10.77 GB 11.42 MB
| All archives: 416.46 GB 408.89 GB 11.34 GB
| Unique chunks Total chunks
| Chunk index: 159048 5920944
| ——————————————————————————
| ——————————————————————————
| Original size Compressed size Deduplicated size
| Deleted data: -11.02 GB -10.78 GB -12.07 MB
| All archives: 405.49 GB 398.12 GB 11.32 GB
| Unique chunks Total chunks
| Chunk index: 159023 5764912
| ——————————————————————————

or another example
docker compose logs | grep backup

shows up jobs like logo_backup and more

kr
Hope it helps.

But it was maybe just my kind of idea to see if backups worked well…

shlomi

maybl8
exempt IP 75.115.XX.XX which I assume is your server’s IP there is no problematic IP here, all the rest are internal IP ranges and there is no problem leaving them.

(I would redact your servers IP address from a public forum)

maybl8

shlomi
Yeah 75.x.x.x is my public ip.
It probably doesn’t matter that everyone sees it.
As a mail server it is being attacked all the time.
But I understand your point.
Thanks

For my understanding of the mail-logs viewer. What IP’s does it need?

Also I just started noticing this in the log.
Is someone trying to attack me because I can open the log page by logging in as admin?

netfilter-mailcow-1  | Address 75.x.x.x/32 is whitelisted by rule 75.x.x.x/32
netfilter-mailcow-1  | 75.x.x.x matched rule id 1 (mailcow UI: Invalid password for API_USER by 75.x.x.x)

maybl8

maybl8
So I see there is an update available.
Do I just replace the .env and dockercompose files and run the docker up command?

shlomi

maybl8
cd into mailcow-logs-vewer folder and run
docker compose pull
and
docker compose up -d

« Previous Page Next Page »