emails deleted from inbox

z3d3m0n

• August 09, 2018 06:06

Hello Guys, user is claiming emails has been deleted from inbox, is there any log that could reflect some truth about what has happend ? thanks in advance

• 

  bloatedstoat

  • August 09, 2018 12:11

  Hello @z3d3m0n Have you asked if the user has the email account set up on more than one device? I've had this issue presented in the past. The user set up their email (POP3) on several devices. One of those devices downloaded email from the server, once downloaded the mail was deleted from the server, the user then complained it was no longer available on another device.

  0
• 

  z3d3m0n

  • August 09, 2018 12:31

  the user is using mainly webmail but there is a chance that he has pulled all emails via pop3, is there any place in logs that shows that user has pulled emails via pop3? thx

  0
• 

  bloatedstoat

  • August 09, 2018 12:59

  The maillog shows protocol logins (imap and pop3) via dovecot. You could issue on the command line, assuming you have root access to the server and search for instances of pop3 logins: cat /var/log/maillog | grep user@domain.com and see if that is the case. That said, it does not "prove" that mail was retrieved and then removed, perhaps someone else on the list can chip and offer advice on that.

  0
• 

  cPanelMichael

  • August 09, 2018 17:08

  Hello, The information in the previous post is correct in that you can search /var/log/maillog to see if there was any POP3 activity on the email account. This is the most common reason that email is removed from Webmail, as most POP3 email clients will not automatically keep a copy of the messages stored on the server. Thank you.

  0
• 

  z3d3m0n

  • August 10, 2018 11:55

  Hello

  0
• 

  cPanelMichael

  • August 13, 2018 15:59

  i checked the log and i see only imap- logins and connections, no pop3. any other clues ?

  
  You can also search /usr/local/cpanel/logs/access_log for the email address or cPanel account username to see if another IP address (other than the one utilized by the account holder) logged in via cPanel or Webmail to perform actions. For example, to search for test1 @ domain.com, you'd use a command like this: grep test1%40domain.com /usr/local/cpanel/logs/access_log
  Thank you.

  0

Please sign in to leave a comment.