[Dovecot] Tracing an IP of a user who deleted the message

[Steffen Kaiser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 10 May 2007, Eugene Gladchenko wrote:

> May 10 13:19:04 mailserver dovecot: IMAP(office): copy -> Trash: uid=1131, msgid=<45E669BE.8090705 at example.com>, box=Sent
> May 10 13:19:05 mailserver dovecot: IMAP(office): deleted: uid=1131, msgid=<45E669BE.8090705 at example.com>, box=Sent
> May 10 13:53:08 mailserver dovecot: IMAP(office): copy -> Trash: uid=1719, msgid=<002701b483f5$7aa257e0$23833bda at example.com>
> May 10 13:53:08 mailserver dovecot: IMAP(office): deleted: uid=1719, msgid=<002701b483f5$7aa257e0$23833bda at example.com>
>
You can log the PID, too:

# Log prefix for mail processes. See doc/wiki/Variables.txt for list of
# possible variables you can use.
#mail_log_prefix = "%Us(%u): "
mail_log_prefix = "%Us(%u) [%p]: "

Then you can trace the PID.

Bye,

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBRkL6Oi9SORjhbDpvAQJlRQf+Kuynm+PpXPlHrbWf2gsLJlS/dx8vlYcx
hP/Fn3y7SvXCJOrC3K73tMeE2BY8dQ8iqKxgQFtaDPinoQ3T/D8UIpj6z+DfOA07
z2nMh8FnchBSSNSXRAUqziYVkTOuUPBPjQP9ZXDnRmGTSdqy9VM0iuNSAP7DEOYo
z1hdsL8yOSrBfwUKVaVmpxHJ77CUfyIwlVrGKDEiIG1nVGWP4MJ9VhT7SyfO+JHk
lWjHpLIN+kS8wwKgYadZcUWgo5TvAXdhCWZ10j09Ep1DtovvUu2J6Dhiody9Uc65
SqFRyVUG+XsuW1UpHKK9L8rsZbNg5VaTncg5MAnq3+nOs2iCQQ5g+g==
=8abn
-----END PGP SIGNATURE-----