Yes in the msg logs every delete is logged so you should be able to find
the "del" entries related to the missing mesages, and thus the ip address
responsible.
Start by searching based on the utc time stamp of a missing message, e.g.
find the delivery entry like this:
....
Stored locally /xxxxxxxxx/mdir/new/1407705096.30834_46255.netwin.netwinsite.co"
burst 127.0.0.1 . <sales@netwin.co.nz> 0 . "burst 1407705096.30834_46255.netwin.netwinsite.co --> u46968~2,(0,72203)[1407705096]
The key to search on is "1407705096", so then search the logs for that to
find where it's mentioned again, also you will find a 'uid' entry related to the
message, search on the uid number too.
So then search again on u46968
Between those you should be able to find all relevant information
pertaining to that message.
Also you should check the user level expiration rules.
Lookup account, Mailbox, Nightly Rules
ChrisP.
It is not on and also it is only one user who has that problem. If it is
some (forgotten) IMAP client, how would I find it in the logs?
Anything else I can find in the logs?
