[Dovecot] Emails Disappearing -- Mystery

[Steffen Kaiser]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 11 Mar 2010, Mario Antonio wrote:

> 1)
> The user shuts down his apple mail software, his Iphone, and the Web 
> interface:

OK, but are you _sure_ that no other user / connection accesses the 
mailbox?

> 2)
> 2010-03-11 15:54:48 deliver(my_user at mydomain.com): Info: 
> From=noreply at craigslist.org : 
> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org> : saved mail to 
> INBOX

OK, Sieve has been processed now, Postfix & Dovecot are done with the 
message.

> 3)
> Email is deleted !!!
> 2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: delete: uid=10719, 
> flags=(\Deleted \Recent $Junk),
> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
> from=craigslist.org <noreply at craigslist.org>, subject=POST/EDIT/DELETE : 
> (accounting/financejobs) Test Post
> 2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: expunge: uid=10719, 
> flags=(\Deleted \Recent $Junk),
> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
> from=craigslist.org <noreply at craigslist.org>, subject=POST/EDIT/DELETE : 
> (accounting/finance jobs) Test Post , size=2776
>
> Who is deleting this email ?
> I can see the flag $Junk ... perhaps some filter somewhere is seeing that 
> flag and proceeding to delete it.

There is another MUA monitoring this mailbox.
It does not seem to be Thunderbird, as it seems to use the "Junk" keyword.

I think you can use tools like "fuser" or "lsof" on the index of the 
user's INBOX to get the pid of the process. Dunno if there are tools to 
detect inotify/epoll/etc. on a directory.

Regards,

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBS5n8dL+Vh58GPL/cAQLcGAgAseTfkuExZTSy0Ma13Wdti7CrXq3DH2Kf
tGfXsEDiaQOA02jmk20GcnnDZAjxyoBFYPOQ5dqBLSUE/5IaTnXPzZV0WPIWn4nY
MyOQxYuVmiMOf29gjhzRb0hZLtNq/aJ0zeMTqv2E6NtY7iH/wJ3g7RSYW5116Awz
v5ITpa8X1PwSuQS4SidFQbsgGU7kO6sqDUBnHY3dUX9p0kpdawTk4L/j2U7etFQY
JWT79PLcZWL/fGLPkz8UQmeGT7zvI4YfrwDp93k8qHcbgrDkjt0WuWk+DLvJcZqR
pFEhNw99kZ4AeYq3cqsAZDeQ/gAXu0IGd5wOsiyXuIp8d+/NJUxtgA==
=wWcG
-----END PGP SIGNATURE-----