As usual the default logcheck rules are not sufficient. These are the rules I added to my ignore.d.server/dovecot file: ^\w{3} [ :[:digit:]]{11} [.[:alnum:]-]+ dovecot: lmtp([[:digit:]]{5}): (Connect from local|Disconnect from local: Successful quit) ^\w{3} [ :[:digit:]]{11} [.[:alnum:]-]+ (dovecot: )?(deliver|lmtp)([-.@[:alnum:]]+): sieve: msgid=>?( (((added by )?[^[:space:]]+|sfid-[[:xdigit:]]+))?)?[[:space:]]: (stored mail into mailbox ‘.’|marked message to be dis carded if not […]