On 7 Nov 2011, at 14:23, Adrian Kovacs wrote: > hi > > how can I check if a user deleted a mail ? > Is there is history somewhere? > How can I read the cyrus.index file?
If the message isn't in the mailbox, presumably it's been deleted. You can work out the file name from the delivery time. Delivery is logged. Files are named sequentially, by number. If your backup system made a backup of the file, then you can verify by restoring the backup. Otherwise, you're relying on delivery logs. On our system, /var/log/mail logs the following, all with timestamps of course: message deliveries: with message id, and mailbox. logins: username. Expunges: mailbox, number of messages expunged. So, if the message was delivered, and you can tie up the message id with your smtp logs, and then you can see that the user logged in and expunged the mailbox, and the message isn't there, that should be pretty good evidence. > We are using cyrus & postfix, and would like to check if a user deleted a > certain mail > > thanks > > a > ---- > Cyrus Home Page: http://www.cyrusimap.org/ > List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/ -- Ian Eiloart Postmaster, University of Sussex +44 (0) 1273 87-3148 ---- Cyrus Home Page: http://www.cyrusimap.org/ List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
