diff --git a/data/event_categories.js b/data/event_categories.js
index 1068494b0..cc8d60475 100644
--- a/data/event_categories.js
+++ b/data/event_categories.js
@@ -37,6 +37,11 @@ export const categories = {
 		description: `DNS client library`
 	},
 
+	doveadm: {
+		category: 'root',
+		description: `[[link,doveadm]] commands`
+	},
+
 	fs: {
 		category: 'root',
 		description: `FS library`
diff --git a/data/events.js b/data/events.js
index 7e8b12153..cd519a71e 100644
--- a/data/events.js
+++ b/data/events.js
@@ -1440,6 +1440,41 @@ Connection to proxy failed, but reconnect will be attempted.
 event.`
 	},
 
+	/* doveadm */
+
+	doveadm_command_finished: {
+		root: 'doveadm',
+		added: {
+			events_doveadm_command_finished_added: false,
+		},
+		fields: {
+			command: `Name of the doveadm command that was run. Not set if no command could be resolved.`,
+			exit_code: `Exit code of the command. See [[link,doveadm_error_codes]].`,
+			user: `
+Username the command was run for, if known.
+
+Set for [[link,doveadm_http_api]] requests (from the command's \`user\`
+parameter) and for doveadm server connections. Not set when doveadm is run
+from the command line.`,
+			agent: `Value of the \`User-Agent\` header. Only set for [[link,doveadm_http_api]] requests, and only if the client sent the header.`,
+			local_ip: `Local IP address the client connected to. Not set when doveadm is run from the command line.`,
+			local_port: `Local port the client connected to. Not set when doveadm is run from the command line.`,
+			remote_ip: `Remote IP address of the client. Not set when doveadm is run from the command line.`,
+			remote_port: `Remote port of the client. Not set when doveadm is run from the command line.`,
+			origin: `Origin of the command: \`cli\`, \`http\` or \`tcp\`, depending on how the command was issued.`,
+		},
+		text: `
+A doveadm command has finished running.
+
+Emitted for all three ways a command can be run: from the command line, over
+the doveadm server protocol, and via the [[link,doveadm_http_api]].
+
+For doveadm server connections the event also inherits the fields of the
+connection the command was run for; for the HTTP API this additionally
+includes the request's [[event,http_server_request_started]] fields, e.g.
+\`method\`, \`target\` and \`request_id\`.`
+	},
+
 }
 
 /* 'Global Inherits': All events inherit these fields. */
diff --git a/data/updates.js b/data/updates.js
index 7aac9731d..5b6bd3dea 100644
--- a/data/updates.js
+++ b/data/updates.js
@@ -122,6 +122,7 @@ export const updates = {
 	events_auth_server_userdb_userdb_driver_added: '2.4.0',
 	events_auth_server_userdb_userdb_name_removed: '2.4.0',
 	events_dns_worker_request_finished_cached_added: '2.4.0',
+	events_doveadm_command_finished_added: '2.4.6',
 	events_imap_id_received_added: '2.4.0',
 	events_imap_id_received_internal_added: '2.4.3',
 	events_invalid_credentials_added: '2.4.5',
diff --git a/docs/installation/upgrade/2.4-to-2.4.x.md b/docs/installation/upgrade/2.4-to-2.4.x.md
index df8f71074..c3fee63e2 100644
--- a/docs/installation/upgrade/2.4-to-2.4.x.md
+++ b/docs/installation/upgrade/2.4-to-2.4.x.md
@@ -186,3 +186,5 @@ INBOX namespace.
 ### v2.4.5 to v2.4.6
 
 <!-- @include: include/2.4.6-auth-empty-password.inc -->
+
+<!-- @include: include/2.4.6-doveadm-logging.inc -->
diff --git a/docs/installation/upgrade/include/2.4.6-doveadm-logging.inc b/docs/installation/upgrade/include/2.4.6-doveadm-logging.inc
new file mode 100644
index 000000000..931358737
--- /dev/null
+++ b/docs/installation/upgrade/include/2.4.6-doveadm-logging.inc
@@ -0,0 +1,21 @@
+#### Doveadm Logging Changes
+
+`doveadm-server` no longer writes the Apache-style access log line for each
+[[link,doveadm_http_api]] request. The same information is now available from
+events: [[event,doveadm_command_finished]] for the command, the user and the
+exit code, and [[event,http_server_request_finished]] for the HTTP status and
+the transferred byte counts. Both are debug level events, so use
+[[link,event_export]] to record them. Note that the format differs from the
+old log line.
+
+[[event,doveadm_command_finished]] is emitted for command line and
+doveadm server protocol invocations as well, not just for the HTTP API.
+
+Some [[link,doveadm_http_api]] log lines also changed level:
+
+| Log line | Old Level | New Level |
+| -------- | --------- | --------- |
+| `Executing command`, `Executing command as '<user>'` | info | debug |
+| `Error writing output in command <cmd>: <error>` | info | error |
+| `read(<stream>) failed: <error>` | info | error |
+| `error writing output: <error>` | info | error |