[Dovecot] Emails Disappearing -- Mystery
I got a case that I haven't been able to resolve. I hope somebody can give me some hints.
One of our users is reporting emails disappearing in front of his eyes,
(Right ... emails filters at the client side ....)
Server does not have global sieve filter enabled (no file present), even though this configuration is present: sieve_global_path=/vmail/globalsieverc
User does not have any sieve scripts enabled at the server side.
Ok,
- The user shuts down his apple mail software, his Iphone, and the Web interface:
2010-03-11 15:52:57 IMAP(my_user@mydomain.com): Info: Connection closed bytes=2188/6499 2010-03-11 15:52:57 IMAP(my_user@mydomain.com): Info: Connection closed bytes=3887/7336 2010-03-11 15:52:57 IMAP(my_user@mydomain.com): Info: Connection closed bytes=5873/68309 2010-03-11 15:52:57 IMAP(my_user@mydomain.com): Info: Disconnected in IDLE bytes=4514/547136
He generates the troublesome emails from a notification system in Craiglist .... We can see the email hitting the inbox (we also see in Postfix this email going to Dovecot) 2010-03-11 15:54:48 deliver(my_user@mydomain.com): Info: From=noreply@craigslist.org : msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org : saved mail to INBOX
Email is deleted !!! 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: delete: uid=10719, flags=(\Deleted \Recent $Junk), msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org, from=craigslist.org noreply@craigslist.org, subject=POST/EDIT/DELETE : (accounting/financejobs) Test Post 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: expunge: uid=10719, flags=(\Deleted \Recent $Junk), msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org, from=craigslist.org noreply@craigslist.org, subject=POST/EDIT/DELETE : (accounting/finance jobs) Test Post , size=2776
Who is deleting this email ? I can see the flag $Junk ... perhaps some filter somewhere is seeing that flag and proceeding to delete it. If I understand sieve filters at the server side, they will act in the deliver process. So once the email is saved into INBOX, sieve filters will not count. Am I right?
Any Hints?
# 1.2.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.26-2-686-bigmem i686 Debian 5.0.4 xfs
Regards,
Mario Antonio
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Thu, 11 Mar 2010, Mario Antonio wrote:
- The user shuts down his apple mail software, his Iphone, and the Web interface:
OK, but are you _sure_ that no other user / connection accesses the mailbox?
- 2010-03-11 15:54:48 deliver(my_user@mydomain.com): Info: From=noreply@craigslist.org : msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org : saved mail to INBOX
OK, Sieve has been processed now, Postfix & Dovecot are done with the message.
- Email is deleted !!! 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: delete: uid=10719, flags=(\Deleted \Recent $Junk), msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org, from=craigslist.org noreply@craigslist.org, subject=POST/EDIT/DELETE : (accounting/financejobs) Test Post 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: expunge: uid=10719, flags=(\Deleted \Recent $Junk), msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org, from=craigslist.org noreply@craigslist.org, subject=POST/EDIT/DELETE : (accounting/finance jobs) Test Post , size=2776
Who is deleting this email ? I can see the flag $Junk ... perhaps some filter somewhere is seeing that flag and proceeding to delete it.
There is another MUA monitoring this mailbox. It does not seem to be Thunderbird, as it seems to use the "Junk" keyword.
I think you can use tools like "fuser" or "lsof" on the index of the user's INBOX to get the pid of the process. Dunno if there are tools to detect inotify/epoll/etc. on a directory.
Regards,
Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBS5n8dL+Vh58GPL/cAQLcGAgAseTfkuExZTSy0Ma13Wdti7CrXq3DH2Kf tGfXsEDiaQOA02jmk20GcnnDZAjxyoBFYPOQ5dqBLSUE/5IaTnXPzZV0WPIWn4nY MyOQxYuVmiMOf29gjhzRb0hZLtNq/aJ0zeMTqv2E6NtY7iH/wJ3g7RSYW5116Awz v5ITpa8X1PwSuQS4SidFQbsgGU7kO6sqDUBnHY3dUX9p0kpdawTk4L/j2U7etFQY JWT79PLcZWL/fGLPkz8UQmeGT7zvI4YfrwDp93k8qHcbgrDkjt0WuWk+DLvJcZqR pFEhNw99kZ4AeYq3cqsAZDeQ/gAXu0IGd5wOsiyXuIp8d+/NJUxtgA== =wWcG -----END PGP SIGNATURE-----
On 3/12/2010 3:33 AM, Steffen Kaiser wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Thu, 11 Mar 2010, Mario Antonio wrote:
- The user shuts down his apple mail software, his Iphone, and the Web interface:
OK, but are you _sure_ that no other user / connection accesses the mailbox?
- 2010-03-11 15:54:48 deliver(my_user@mydomain.com): Info: From=noreply@craigslist.org : msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org : saved mail to INBOX
OK, Sieve has been processed now, Postfix & Dovecot are done with the message.
- Email is deleted !!! 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: delete: uid=10719, flags=(\Deleted \Recent $Junk), msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org, from=craigslist.org noreply@craigslist.org, subject=POST/EDIT/DELETE : (accounting/financejobs) Test Post 2010-03-11 15:54:49 IMAP(my_user@mydomain.com): Info: expunge: uid=10719, flags=(\Deleted \Recent $Junk), msgid=20100311205447.0C0FE118B04@web8p.int.craigslist.org, from=craigslist.org noreply@craigslist.org, subject=POST/EDIT/DELETE : (accounting/finance jobs) Test Post , size=2776
Who is deleting this email ? I can see the flag $Junk ... perhaps some filter somewhere is seeing that flag and proceeding to delete it.
There is another MUA monitoring this mailbox. It does not seem to be Thunderbird, as it seems to use the "Junk" keyword.
I think you can use tools like "fuser" or "lsof" on the index of the user's INBOX to get the pid of the process. Dunno if there are tools to detect inotify/epoll/etc. on a directory.
Regards,
- -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBS5n8dL+Vh58GPL/cAQLcGAgAseTfkuExZTSy0Ma13Wdti7CrXq3DH2Kf tGfXsEDiaQOA02jmk20GcnnDZAjxyoBFYPOQ5dqBLSUE/5IaTnXPzZV0WPIWn4nY MyOQxYuVmiMOf29gjhzRb0hZLtNq/aJ0zeMTqv2E6NtY7iH/wJ3g7RSYW5116Awz v5ITpa8X1PwSuQS4SidFQbsgGU7kO6sqDUBnHY3dUX9p0kpdawTk4L/j2U7etFQY JWT79PLcZWL/fGLPkz8UQmeGT7zvI4YfrwDp93k8qHcbgrDkjt0WuWk+DLvJcZqR pFEhNw99kZ4AeYq3cqsAZDeQ/gAXu0IGd5wOsiyXuIp8d+/NJUxtgA== =wWcG -----END PGP SIGNATURE-----
Steffen,
Thanks for your reply. I really appreciate it. That's my conclusion too. There must be another email client somewhere with a filter .. I just wanted to confirm from the Gurus that after the email is saved into the inbox, Server side Dovecot process cannot be blamed for a Delete/Expunge instance (if we know that no plugin of that nature is present in the server)
M.A.
participants (2)
-
Mario Antonio
-
Steffen Kaiser