Inbox mail missing

Pitkud

• March 05, 2018 21:33

Hi, I have an issue with one of our user, she was out of the office for sometime (25th february until march 5) and when she got back to the office apparently her Inbox mails were gone by somehow, and there is no trace of the emails in the trash folder (she's using microsoft outlook). I've checked access_logs in /usr/local/cpanel/logs and can't find any transactions between february 22 and march 3 on her account, but in WHM mail delivery reports and /var/log/maillog i still see that there were transactions at her account. Can you point me where to check what happened to her mail inbox ? This is my server info CentOS Linux release 7.4.1708 (Core) cpanel version:11.68.0.29 envtype:vmware

• 

  24x7server

  • March 06, 2018 05:16

  Hi, You can use the below command to check the delivery of the mail processed properly or not. You said that you have the ID, so you can use that to check what actually happened the mail.. # exigrep /var/log/exim_mainlog Additionally, you can also refer to the below cPanel documentations: Mail Delivery Reports - Version 68 Documentation - cPanel Documentation

  0
• 

  Pitkud

  • March 06, 2018 06:32

  Hi, I tried to use the command and it showed there were successful transactions 2018-02-28 19:36:59 1er0yg-0007Ro-RE -> ID R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 WOkNBmuillqXbwAADmVvvQ:2 Saved" 2018-02-28 19:36:59 1er0yg-0007Ro-RE Completed But when she got back from her trip and turn on her pc to check new emails, those emails weren't in her inbox, it's gone not even in her outlook trash. Can cpanel log shows when, if accidentally she deleted the emails ?

  0
• 

  cPanelMichael

  • March 06, 2018 14:25

  Hello, It's possible the messages were downloaded from the server via a POP3 email client. Try searching the email address in /var/log/maillog to see if messages were downloaded or accessed. EX: grep "user@domain.tld" /var/log/maillog
  Thank you.

  0
• 

  Pitkud

  • March 07, 2018 07:53

  Hi, This is example of the maillog result of the user, more of them are like these, Feb 28 19:19:23 svr1 dovecot: imap-login: Login: user=, method=PLAIN, rip=IP 1.2.3.4, lip= IP 5.6.7.8, mpid=27751, TLS, session= Feb 28 19:23:03 svr1 dovecot: imap(id@domain.com): Logged out in=1282, out=4293, bytes=1282/4293 Feb 28 19:33:19 svr1 dovecot: lmtp(id@domain.com): msgid=<001a01d3b090$51317010$f3945030$@domain.com>: saved mail to INBOX

  0
• 

  cPanelMichael

  • March 07, 2018 18:17

  Hello, That's an IMAP entry, and it doesn't show any information that suggests messages were deleted. Can you verify if the messages exist when accessing the email account in one of the provided webmail applications (e.g. Horde, Roundcube)? Thank you.

  0
• 

  Pitkud

  • March 09, 2018 06:07

  Hi Michael, Problem solved, apparently the user is using notebook while she's not in the office and download the emails using POP3, i must have missed the logs that user is using pop3 to download the emails in maillog. Thanks in advance

  0
• 

  cPanelMichael

  • March 09, 2018 17:15

  Hello, I'm glad to see you were able to solve the issue. Thank you for sharing the outcome.

  0

Please sign in to leave a comment.