-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Thu, 11 Mar 2010, Mario Antonio wrote:
- The user shuts down his apple mail software, his Iphone, and the Web interface:
OK, but are you _sure_ that no other user / connection accesses the mailbox?
- 2010-03-11 15:54:48 deliver(my_user@mydomain.com): Info: From=noreply@craigslist.org : msgid=<20100311205447.0C0FE118B04@web8p.int.craigslist.org> : saved mail to INBOX
OK, Sieve has been processed now, Postfix & Dovecot are done with the message.
- Email is deleted !!! 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: delete: uid=10719, flags=(\Deleted \Recent $Junk), msgid=<20100311205447.0C0FE118B04@web8p.int.craigslist.org>, from=craigslist.org <noreply@craigslist.org>, subject=POST/EDIT/DELETE : (accounting/financejobs) Test Post 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: expunge: uid=10719, flags=(\Deleted \Recent $Junk), msgid=<20100311205447.0C0FE118B04@web8p.int.craigslist.org>, from=craigslist.org <noreply@craigslist.org>, subject=POST/EDIT/DELETE : (accounting/finance jobs) Test Post , size=2776
Who is deleting this email ? I can see the flag $Junk ... perhaps some filter somewhere is seeing that flag and proceeding to delete it.
There is another MUA monitoring this mailbox. It does not seem to be Thunderbird, as it seems to use the "Junk" keyword.
I think you can use tools like "fuser" or "lsof" on the index of the user's INBOX to get the pid of the process. Dunno if there are tools to detect inotify/epoll/etc. on a directory.
Regards,
Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBS5n8dL+Vh58GPL/cAQLcGAgAseTfkuExZTSy0Ma13Wdti7CrXq3DH2Kf tGfXsEDiaQOA02jmk20GcnnDZAjxyoBFYPOQ5dqBLSUE/5IaTnXPzZV0WPIWn4nY MyOQxYuVmiMOf29gjhzRb0hZLtNq/aJ0zeMTqv2E6NtY7iH/wJ3g7RSYW5116Awz v5ITpa8X1PwSuQS4SidFQbsgGU7kO6sqDUBnHY3dUX9p0kpdawTk4L/j2U7etFQY JWT79PLcZWL/fGLPkz8UQmeGT7zvI4YfrwDp93k8qHcbgrDkjt0WuWk+DLvJcZqR pFEhNw99kZ4AeYq3cqsAZDeQ/gAXu0IGd5wOsiyXuIp8d+/NJUxtgA== =wWcG -----END PGP SIGNATURE-----