How to identify unused email accounts

Introduction

How can I tell which email accounts are not being used or were last used a long time ago? This could help to identify email accounts that can be deleted and minimize the server's disk usage.

Procedure

It is important to recognize that some email users may login to their account daily, while other users may login only once per month, but both users consider their email accounts equally important. It is always recommended to communicate with your users prior to removing their accounts. Additionally, you can make use of quotas to limit the size of accounts.

With that said, to obtain a basic idea about when the email accounts on your server were last used, you can check the Dovecot log (/var/log/maillog).

1. Obtain a list of all email accounts on the server:

# cat /home/*/etc/*/passwd |awk -F'[:/]' '{print $1"@"$10}' |tee -a email-accounts

2. Then check all available Dovecot logs for the last activity for each account:

# while read i;
do
echo -e "\nLast activity for $i"; grep -h $i /var/log/maillog* |sort -M |tail -1;
done <email-accounts

Note that this procedure is only meant to provide a general idea of when the most recent activity for each of your email accounts took place. The Dovecot log includes details about authentication attempts and mailbox activity such as new messages being saved. Some servers are not configured to retain logs for a long period of time, and therefore this procedure may need to be modified by a qualified systems administrator to better suit your requirements.