need help debugging deleted mails

[Vu Ngoc VU]

> Date: Thu, 13 Aug 2015 16:31:02
> From: Marcus Rueckert <darix at opensu.se>
> To: dovecot at dovecot.org
> Subject: Re: need help debugging deleted mails
> 
> On 2015-08-13 16:15:00 +0200, Vu Ngoc VU wrote:
>> I've seen this plugin, but I fear that it will be enabled for all users.
>> I don't have seen an way to enable it only for 1 user like rawlog permits.
>>
>> Maybe, I'll setup a new container for only users that I want to "debug" with that plugin enabled.
>
> TBH the output from this plugin is very valuable for your support team
> in any case. so it doesnt harm  to have it enabled by default.

OK, I'll enable it then.
I added some auditd rule on his Maildir/cur on the storage server.
But looks like it's just a NFS share, events cannot be intercepted.