Skip to main content

Intermittent, Automatic Moves to Trash

tco_jonathan
Hi All, I've been searching, off and on, for months trying to figure out what's going on, but I'm lost and hope you can help. Intermittently, emails are move from my Inbox upon receipt into the server's Trash folder. I specify the "server's" Trash folder because it doesn't appear in my email client (Outlook) on any of my devices (tablet, phone, desktop). I literally have to log into RoundCube to view the deleted messages and move them back to the Inbox. In terms of frequency, this happens at least once a week. I've checked the logs and can find nothing to explain this. I can find no explanation for the move. And it's entirely inconsistent. It happens with messages from multiple domains, hosts, content. Sometimes new messages, sometimes messages in the middle of a thread. My first thought was a spam filter, but I turned off SpamAssassin entirely to check, and it wasn't that. Some details: CentOS 7.5 WHM/cPanel v76.0.14 Any advice, hints, tips, or points in the right direction would be very much appreciated. Thank you, Jonathan

Comments

3 comments

Date Votes
  • tco_jonathan
    Silly me; should have read the guide beforehand: /etc/redhat-release: CentOS Linux release 7.5.1804 (Core) /usr/local/cpanel/version: 11.76.0.14 /var/cpanel/envtype: standard
    0
  • cPanelLauren
    Hi @tco_jonathan I think the best course of action would be to enable dovecot's more detailed logging. This only requires a couple of changes but to make it easier I created a bash script for you to be run as root: 1. touch more_dovecot_logs
    2. Add the following to more_dovecot_logs: #!/bin/sh cd /var/cpanel/templates/dovecot2.2 cp main.default main.local sed -i '677i mail_plugins = $mail_plugins mail_log notify' main.local sed -i '746i plugin { \ # Events TWEET available to log: append copy delete expunge flag_change mailbox_delete mailbox_rename undelete \ mail_log_events = append copy delete expunge flag_change mailbox_delete mailbox_rename undelete \ # Available fields: uid, box, msgid, from, subject, size, vsize, flags \ # size and vsize are available only for expunge and copy events. \ mail_log_fields = uid box msgid size subject flags \ }' main.local /scripts/builddovecotconf /scripts/restartsrv_dovecot
    Keep in mind the sed here correlates to the line number to enter the information into - it could be slightly different but this worked for me 3.chmod +x more_dovecot_logs
    4. run the script ./more_dovecot_logs
    Once that's done dovecot will begin logging much more detailed information to /var/log/maillog
    including any time a message is moved from one folder to another. It might be a good starting point to finding out what is going on. When the issue occurs again you can see exactly what happened.
    0
  • tco_jonathan
    Hi @cPanelLauren Thank you for your detailed advice. I executed everything you suggested and waited. This morning it happened again, finally. (Or, rather, I noticed it happening again). Here's the log for the time in question: Jan 12 08:02:29 server dovecot: lmtp(26797): Connect from local Jan 12 08:02:29 server dovecot: lmtp(jonathan@mydomain.com): msgid=: saved mail to INBOX Jan 12 08:02:29 server dovecot: lmtp(26797): Disconnect from local: Successful quit
    I read the log going back and forward by 10 minutes and saw nothing else of note.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post