Timo Sirainen wrote:

...

However, I noticed a strange thing: querying what would have been deleted

doveadm -ftab fetch -A "date.saved" mailbox Trash savedbefore 7d

showed many date.saved values are clustered around the same timestamp, even among different user's Trash mailbox. ... I can't explain why many different users would have messages with the same (or closeby) date.saved value.

Which mailbox format? With Maildir the date.saved is taken from dovecot.index.cache file, and in some cases that might get dropped. If it does, then it fallbacks to using the file's ctime.

mbox.

A further look into this reveals that the clustered date.saved values are the earliest values for every mailbox in the system. This timestamp is close to the time I was testing "doveadm ... -A", so the likely explanation is that I accidentally deleted/updated these values using some variation of doveadm, even though I remember confining my testing to query/search/fetch. This appears to be a case of PEBKAC.

These "wrong" values shouldn't cause problems with expunge queries since they err on the side of safety.

Thanks for the insight though.

Joseph Tam jtam.home@gmail.com