At a customer we run dovecot-2.4.1 on Debian 13.7

There's a fat public folder for email archive, subscribed by all users.

Via ACLs we only allow some admin users delete-rights there, at least that's how I understand:

group @acl_ruleset acl_ruleset1 { acl user=intranet@my.tld { rights = lrwstipekxa } acl user=adm1@my.tld { rights = lrwstipekxa } acl user=adm2@my.tld { rights = lrwstipekxa } acl authenticated { rights = lrwstip } }

group @acl_ruleset acl_default { acl group=people { rights = lri } acl anyone { rights = lrwstip } }

namespace oeffentlich { mail_path = /home/vmail/oeffentlich mail_index_private_path = %{home}/.public mailbox Oeffentlich { @acl_ruleset = acl_ruleset1 }

mailbox Oeffentlich/* { @acl_ruleset = acl_ruleset1 }

@acl_ruleset = acl_ruleset1

}

The ISSUE: they notice that in various subfolders there are mails deleted, as if folders were trimmed to "maximal 100 emails".

And we don't know who or what does that.

Without proper rights even clients like Thunderbird (which brings such a cleanup feature) couldn't do that.

How could I monitor these deletions without too much logging overload?

I look at https://doc.dovecot.org/main/core/plugins/mail_log.html

Thanks for any pointers!