Results 1 to 8 of 8

Thread: Discovering who deleted shared email

  1. #1
    Join Date
    Mar 2007
    Location
    New England
    Posts
    55
    Rep Power
    8

    Default Discovering who deleted shared email

    I have a very small install of Zimbra where I work. Today, I noticed that all the emails in my companies main inbox are all gone. This inbox is a shared folder that all the salespeople have access to, but no one will say they did it). I am not sure how best to discover who deleted the emails, and when (I have 3 days of backups using the backup script, but most people were gone for the holiday, and so I am pretty sure the emails are gone).

    Sent and trash still exist, but I wanted to know if there was a way to find out who deleted what, and when.

    Thanks,
    Cryo

    P.S. I was able to send a test message to the mailbox, and it appeared, so the mailbox appears to be working.
    Last edited by Cryophallion; 12-01-2008 at 07:12 AM. Reason: added info

  2. #2
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,017
    Rep Power
    24

    Default

    Have a look in /opt/zimbra/log/audit.log to see who accessed the mailbox (I think it has those details).

  3. #3
    Join Date
    Mar 2007
    Location
    New England
    Posts
    55
    Rep Power
    8

    Default

    Only shows today's activity (due to the shutdown from the backups script I assume), and I'm the first one to access it.

    Is there some record in the mysql database?

  4. #4
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,017
    Rep Power
    24

    Default

    Is there a audit.1.gz file where it has been rotated ?

  5. #5
    Join Date
    Mar 2007
    Location
    New England
    Posts
    55
    Rep Power
    8

    Default

    Of course it was rotated... I am officially an idiot.

    Hmm, nothing really there, which means it must have happened this morning (since the account has no email in the inbox, except the one I sent it, and that account gets lots of email).

    So it was one of 3 of us. Nothing somewhere that records deletions? oh well.

  6. #6
    Join Date
    Mar 2007
    Location
    New England
    Posts
    55
    Rep Power
    8

    Default

    Upon further thought, I have to assume a bit flipped or something, as it would have taken some work to delete all that email (multiple pages), although mysql reports it is fine, and an upgrade to 5.11 changed nothing (nor did a re-index). Any thoughts from anyone else?

  7. #7
    Join Date
    Feb 2007
    Location
    Portland, OR
    Posts
    1,147
    Rep Power
    10

    Default

    Did somebody access the mailbox via POP3? Or IMAP for that matter...but via IMAP they would have had to delete it themselves whereas with POP it would have deleted everything downloaded...

  8. #8
    Join Date
    Mar 2007
    Location
    New England
    Posts
    55
    Rep Power
    8

    Default

    Nope, both are disabled. Only access is via web client, and the people who were accessing it wouldn't have done it (nor have the time to delete all those pages of emails)

Similar Threads

  1. MTA service stopping and 1m later starting again?
    By ArcaneMagus in forum Administrators
    Replies: 5
    Last Post: 03-23-2010, 08:43 AM
  2. Zimbra fails after working for 2 weeks
    By Linsys in forum Administrators
    Replies: 10
    Last Post: 10-07-2008, 12:42 AM
  3. need advice on configuring zimbra to work with fax server
    By pheonix1t in forum Administrators
    Replies: 0
    Last Post: 07-11-2007, 07:46 PM
  4. upgrade to 4.0.3 antispam does'nt work
    By lucanannipieri in forum Administrators
    Replies: 14
    Last Post: 11-07-2006, 02:56 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •