Symptoms
When logging into my email, I noticed some of the messages are no longer present. Where did they go?
Description
When Email goes missing, this is often from a user accessing this with a mail client and that mail client downloads and removes, or deletes the mail from the server. To recovery Email, you will need to restore your account.
Workaround
Although to recover your Email, you do need to restore the mail files; you can add additional logging in case this does happen again.
How to enable the Dovecot mail-log plugin
First, we want to perform a grep for the date range and domain in question. Grep for pop and get a count. Replace the month with the three-letter abbreviation and your days. In this case, this represents Jul 25-29th.
grep -cP 'Jul 2[5-9].+pop.+test.tld' /var/log/maillog
If no results are found, this would indicate it was done over an IMAP connection. By default, dovecot does not log this information and requires additional configurations to be added. To enable more verbose logging in order to check this in case it happens again, You can modify the Dovecot configuration and add the following for additional IMAP logging. To add logging to the Dovecot configuration, you will want to set up a main.local file so that your changes are there going forward after new configuration builds, and still make modifications via WHM.
First, navigate to the folder that contains the dovecot template:
First, navigate to the folder that contains the dovecot template:
cd /var/cpanel/templates/dovecot2.3
Next, copy the main.default to main.local
cp main.default main.local
Find the section "protocol imap {" and add the following line to after the last "mail_plugins=" entry
mail_plugins = $mail_plugins mail_log notify
Add the following right before the "protocol imap {" section ends
plugin {
# Events TWEET available to log: append copy delete expunge flag_change mailbox_delete mailbox_rename undelete
mail_log_events = append copy delete expunge flag_change mailbox_delete mailbox_rename undelete
# Available fields: uid, box, msgid, from, subject, size, vsize, flags
# size and vsize are available only for expunge and copy events.
mail_log_fields = uid box msgid size subject flags
}
Rebuild the dovecot.conf
/scripts/builddovecotconf
Restart dovecot
/scripts/restartsrv_dovecot
Please also refer to the dovecot logging documentation if you need to make further modifications to the logging.
Be sure to disable the mail-log plugin when completed. How to disable the Dovecot mail-log plugin