audit / log
Our users use both Thunderbird and web-client for mail clients.
We are using Version 5.0.16_GA_2921.RHEL5_64.FOSS Apr 29, 2009
I suspect that one of my users (or sysadmins) is reading someone elses mail. The user has complained about a "bug" that some read messages have changed back to unread.
His Inbox is not shared, so it would have to be either someone with his password is logging on or a sys admin is reading it using the web admin control panel and clicking View Mail.
Is there any way for me to figure this out? Is there something I can do so that if this happens in the future, I can check who or at what time his mail was accessed?
grep "delegated access" /opt/zimbra/log/mailbox.log
that will show anytime osmeoone has used the view mail option from the admin interface
ye from mailbox log you can find out from which IP mails are being accessed