1 Topic by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Topic: Deleted Messages

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.4
- Linux/BSD distribution name and version: Ubuntu
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): Mysql
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.

root@srv-mx1:/# cat /var/log/mail.log | grep wetransfer.com
May 18 14:32:32 srv-mx1 postfix/smtpd[52619]: connect from o3.email.wetransfer.com[192.254.123.42]
May 18 14:32:33 srv-mx1 postfix/smtpd[52619]: 180EC461B5: client=o3.email.wetransfer.com[192.254.123.42]
May 18 14:32:33 srv-mx1 postfix/qmgr[16616]: 180EC461B5: from=<bounces+922094-102e-vendas=metalleste.com@email.wetransfer.com>, size=41692, nrcpt=1 (queue active)
May 18 14:32:35 srv-mx1 postfix/smtpd[52619]: disconnect from o3.email.wetransfer.com[192.254.123.42]
May 18 14:32:36 srv-mx1 postfix/qmgr[16616]: E04F6461B6: from=<bounces+922094-102e-vendas=metalleste.com@email.wetransfer.com>, size=42321, nrcpt=1 (queue active)
May 18 14:32:36 srv-mx1 amavis[52606]: (52606-06) Passed CLEAN {RelayedInbound}, [192.254.123.42]:21065 [54.194.202.37] <bounces+922094-102e-vendas=metalleste.com@email.wetransfer.com> -> <vendas@metalleste.com>, Queue-ID: 180EC461B5, Message-ID: <591db07dd8730_26f8352a02854666e@worker-p-eu-0596f89981e2acf3c.wetransfer.cc.mail>, mail_id: DqocBBUgyL_i, Hits: -4.7, size: 41698, queued_as: E04F6461B6, dkim_sd=smtpapi:email.wetransfer.com, 2476 ms

====

Hello,

I have some doubts, because one of my clients is complaining that some of their e-mail is disappearing. I already checked and the message was actually received on the day and time he commented. But I can not find the message in the inbox looking through Webmail. So, I would like to know two things:

1 - Is there any record where it saves the time an e-mail was deleted?
2 - In the last line of the log that I posted here, there is an occurrence of Amavis. Could it be that you were responsible for excluding any suspicious messages?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by martinveasey

  • martinveasey
  • Member
  • Offline
  • From: London
  • Registered: 2016-09-14
  • Posts: 20

Re: Deleted Messages

I don't think it's likely that Amavis did anything bad - "Passed CLEAN" means that the email passed all Amavis scanning processes successfully. I would suggest trying to confirm what happened next in the chain and your log seems to cut off too early for this.

I would suggest grepping mail.log for the Queue ID: 180EC461B5 and posting the full output. If things are working OK, I would expect to see an entry like this indicating handover to the dovecot mailboxes:

May 21 12:34:30 mail postfix/pipe[20422]: 180EC461B5: to=<client@email.address>, relay=dovecot, delay=0.15, delays=0.05/0.01/0/0.09, dsn=2.0.0, status=sent (delivered via dovecot service)
May 21 12:34:30 mail postfix/qmgr[13201]: 180EC461B5: removed

At a wild guess - has your client checked their Spam/Junk and/or Trash folders?

I'm not aware of any audit trail showing Delete times within dovecot.

3 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

I already checked this option too. I already searched both the Outlook (e-mail application) the corresponding folders (junk, trash) and did not find the message.

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Deleted Messages

Hi @ramonalonso,

Did you check Postfix log file as @martinveasey mentioned? If you see "delivered via dovecot service", that means email was successfully delivered to user's mailbox.

You may need to check whether this user has some mail filter rule to redirect received email (Roundcube -> Settings -> Filters).

5 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

Hello, yes I checked. The message was delivered correctly. Even my client printed the email only that later when he was needing the email again the message was gone. What I'm wondering is: If the message was deleted (unintentionally) by the user, how do I check this through the server logs?

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Deleted Messages

What do you need to check? If email was deleted, you lose it -- unless you have some backup, for example, bcc.

7 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

ZhangHuangbin I need a confirmation through the server logs that the message was deleted by the user and there was a server failure.

8 Reply by martinveasey

  • martinveasey
  • Member
  • Offline
  • From: London
  • Registered: 2016-09-14
  • Posts: 20

Re: Deleted Messages

This might help you ... but it is a little old:

https://www.dovecot.org/list/dovecot/20 … 32459.html

Dovecot doesn't routinely log to this level of granularity - I suspect it's because it would rapidly make the log size massively run out of control.

I would certainly recommend some sort of backup process - for me, I host my mail server in the cloud and then use rsnapshot.org to pull a three-hourly copy of emails to my ubuntu server at home. It works incrementally, so the first run is slow but then later ones are much faster. I also pay my cloud provider a little extra to run weekly backups.

9 Reply by ramonalonso (edited by ramonalonso 2017-05-25 02:12:20)

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

I understand. At this point I'm not worried about backup because we do a daily backup. But the backup is something that I make available to the client only in the last case. What I am wanting is to prove that the guilt of the e-mail has disappeared, is not ours, but of the client. You see? That is why I would need a log that would show the time and IP that was requested to delete.

10 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Deleted Messages

If you just want to get a log line of mail deletion, try Dovecot plugin "mail_log":
https://wiki2.dovecot.org/Plugins/MailLog

Note: you can log "from:" and "subject".

11 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

Hello, I found this tutorial:

http://blog.ceae.info/how-to-activate-d … lete-mail/

But when you add Dovecot you have problems:

May 25 18:22:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Internal error occurred. Refer to server log for more information.
May 25 18:23:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap-login: Login: user=<postmaster@ideacorp.com.br>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=7872, secured, session=<FBXQUV1Q
May 25 18:23:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Couldn't load required plugin /usr/lib/dovecot/modules/lib20_mail_log_plugin.so: Plugin notify
May 25 18:23:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Internal error occurred. Refer to server log for more information.
May 25 18:24:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap-login: Login: user=<postmaster@ideacorp.com.br>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=7893, secured, session=<wpljVV1Q
May 25 18:24:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Couldn't load required plugin /usr/lib/dovecot/modules/lib20_mail_log_plugin.so: Plugin notify
May 25 18:24:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Internal error occurred. Refer to server log for more information.
May 25 18:25:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap-login: Login: user=<postmaster@ideacorp.com.br>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=7918, secured, session=<8xT3WF1Q
May 25 18:25:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Couldn't load required plugin /usr/lib/dovecot/modules/lib20_mail_log_plugin.so: Plugin notify
May 25 18:25:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Internal error occurred. Refer to server log for more information.

12 Reply by martinveasey (edited by martinveasey 2017-05-26 17:33:24)

  • martinveasey
  • Member
  • Offline
  • From: London
  • Registered: 2016-09-14
  • Posts: 20

Re: Deleted Messages

Looking at the tutorial, I'm going to guess here:

in 10-logging.conf, have you got "mailbox_rename" on a line of its own or as a continuation of the line above:

"mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename"

It should be the second one.

If this isn't the problem, perhaps you could copy and paste the parts of the .conf files you edited so we could take a look?


PS - working through the tutorial, I found it easier to enable the mail_plugins section in /etc/dovecot/dovecot.conf rather than /etc/dovecot/conf.d/20-imap.conf

13 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

I did it both ways. In the /etc/dovecot/dovecot.conf file, you give this error as before. In the file it indicates it presents an inconsistency to access the email accounts through webmail.

14 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

Up.

15 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Deleted Messages

ramonalonso wrote:

May 25 18:23:38 srv-mx2.ideacorp.com.br dovecot[7727]: imap(postmaster@ideacorp.com.br): Error: Couldn't load required plugin /usr/lib/dovecot/modules/lib20_mail_log_plugin.so: Plugin notify

It's clear here.

Which Ubuntu release are you running? also the Dovecot version?

16 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

Hi ZhangHuangbin

root@srv-mx2:/# lsb_release --all
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.2 LTS
Release:        16.04
Codename:       xenial

root@srv-mx2:/# dovecot --version
2.2.22 (fe789d2)

17 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Deleted Messages

No idea, i use Dovecot working fine with these plugins, all are official apt repos.

# dpkg -l | grep -i dovecot
ii  dovecot-core                       1:2.2.22-1ubuntu2.4                        amd64        secure POP3/IMAP server - core files
ii  dovecot-imapd                      1:2.2.22-1ubuntu2.4                        amd64        secure POP3/IMAP server - IMAP daemon
ii  dovecot-lmtpd                      1:2.2.22-1ubuntu2.4                        amd64        secure POP3/IMAP server - LMTP server
ii  dovecot-managesieved               1:2.2.22-1ubuntu2.4                        amd64        secure POP3/IMAP server - ManageSieve server
ii  dovecot-mysql                      1:2.2.22-1ubuntu2.4                        amd64        secure POP3/IMAP server - MySQL support
ii  dovecot-pop3d                      1:2.2.22-1ubuntu2.4                        amd64        secure POP3/IMAP server - POP3 daemon
ii  dovecot-sieve                      1:2.2.22-1ubuntu2.4                        amd64        secure POP3/IMAP server - Sieve filters support

# dpkg -L dovecot-core | grep plugin | grep notify
/usr/lib/dovecot/modules/lib15_notify_plugin.so

# dovecot -n | grep '^mail_plugins'
mail_plugins = quota mailbox_alias acl mail_log notify stats

# service dovecot status
● dovecot.service - Dovecot IMAP/POP3 email server
   Loaded: loaded (/lib/systemd/system/dovecot.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2017-06-06 00:18:07 CST; 7min ago
     Docs: man:dovecot(1)
   ...

18 Reply by ramonalonso

  • ramonalonso
  • Member
  • Offline
  • Registered: 2015-11-15
  • Posts: 57

Re: Deleted Messages

I can add. It gets normal status sometimes. But it is giving trouble to enter the webmail. Is yours normal?

19 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: Deleted Messages

What trouble? i didn't get any trouble/issue.