[Dovecot] Emails Disappearing -- Mystery

[Mario Antonio]

On 3/12/2010 3:33 AM, Steffen Kaiser wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, 11 Mar 2010, Mario Antonio wrote:
>
>> 1)
>> The user shuts down his apple mail software, his Iphone, and the Web 
>> interface:
>
> OK, but are you _sure_ that no other user / connection accesses the 
> mailbox?
>
>> 2)
>> 2010-03-11 15:54:48 deliver(my_user at mydomain.com): Info: 
>> From=noreply at craigslist.org : 
>> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org> : saved 
>> mail to INBOX
>
> OK, Sieve has been processed now, Postfix & Dovecot are done with the 
> message.
>
>> 3)
>> Email is deleted !!!
>> 2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: delete: 
>> uid=10719, flags=(\Deleted \Recent $Junk),
>> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
>> from=craigslist.org <noreply at craigslist.org>, 
>> subject=POST/EDIT/DELETE : (accounting/financejobs) Test Post
>> 2010-03-11 15:54:49 IMAP(my_user at mydomain.com): Info: expunge: 
>> uid=10719, flags=(\Deleted \Recent $Junk),
>> msgid=<20100311205447.0C0FE118B04 at web8p.int.craigslist.org>, 
>> from=craigslist.org <noreply at craigslist.org>, 
>> subject=POST/EDIT/DELETE : (accounting/finance jobs) Test Post , 
>> size=2776
>>
>> Who is deleting this email ?
>> I can see the flag $Junk ... perhaps some filter somewhere is seeing 
>> that flag and proceeding to delete it.
>
> There is another MUA monitoring this mailbox.
> It does not seem to be Thunderbird, as it seems to use the "Junk" 
> keyword.
>
> I think you can use tools like "fuser" or "lsof" on the index of the 
> user's INBOX to get the pid of the process. Dunno if there are tools 
> to detect inotify/epoll/etc. on a directory.
>
> Regards,
>
> - -- Steffen Kaiser
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iQEVAwUBS5n8dL+Vh58GPL/cAQLcGAgAseTfkuExZTSy0Ma13Wdti7CrXq3DH2Kf
> tGfXsEDiaQOA02jmk20GcnnDZAjxyoBFYPOQ5dqBLSUE/5IaTnXPzZV0WPIWn4nY
> MyOQxYuVmiMOf29gjhzRb0hZLtNq/aJ0zeMTqv2E6NtY7iH/wJ3g7RSYW5116Awz
> v5ITpa8X1PwSuQS4SidFQbsgGU7kO6sqDUBnHY3dUX9p0kpdawTk4L/j2U7etFQY
> JWT79PLcZWL/fGLPkz8UQmeGT7zvI4YfrwDp93k8qHcbgrDkjt0WuWk+DLvJcZqR
> pFEhNw99kZ4AeYq3cqsAZDeQ/gAXu0IGd5wOsiyXuIp8d+/NJUxtgA==
> =wWcG
> -----END PGP SIGNATURE-----
>
>
Steffen,

Thanks for your reply. I really appreciate it.
That's my conclusion too. There must be another email client somewhere 
with a filter ..
I just wanted to confirm from the Gurus  that after the email is saved 
into the inbox, Server side Dovecot process cannot be blamed for a 
Delete/Expunge instance (if we know that no plugin of that nature is 
present in the server)

M.A.