Was /opt/zimbra/log/zimbra.log disabled?

[tilinhonh]

After I had my zimbra server updated (no it's Release 4.5.6_GA_1044.SuSEES9_20070706142155 SuSEES9 FOSS edition) I didn't find /opt/zimbra/log/zimbra.log where deleted e-mails and pop3 deletions were logged.

Now, some emails have disappeared and I cannot find the reason out.

All the services are runnning:
antispam Running
antivirus Running
ldap Running
logger Running
mailbox Running
mta Running
snmp Running
spell Running

I cannot belive this log has been removed. It's quite useful. Maybe it has changed it's name or my log hasn't been enabled. Any tip?

Thanks in advance

[mmorse]

Nope, it just got renamed (to avoid confusion with /var/log/zimbra.log)

You want /opt/zimbra/log/mailbox.log (which was /opt/zimbra/log/zimbra.log prior to 4.5)

Bug 12445 - rename /opt/zimbra/log/zimbra.log

The current log list: /docs/ne/latest/administration_guide/9_Monitoring.12.1.html#1075561

[tilinhonh]

Theres no such log anymore. /opt/zimbra/log/zimbra.log was replaced by /opt/zimbra/log/mailbox.log. Its content is not the same though.


I think the prior log was the only one to register the information I've been looking for.

pop deletion.
(cat /opt/zimbra.old/log/zimbra.log* | grep -i delet | grep -i pop)
2007-08-09 11:32:47,046 INFO [Pop3Server-535373] [ip=xxx.xxx.xxx.xxx;name=user@domain.com;] FileBlobStore - deleting blob 52663 in mailbox 89

user deletion on purpose
(cat /opt/zimbra.old/log/zimbra.log* | grep -i delet | grep -iv pop)
2007-08-09 17:52:10,752 INFO [LmtpServer-15160] [] FileBlobStore - deleting blob file (path=/opt/zimbra/store/incoming/1186667417303-509.msg, vol=1)


Thanks

[tilinhonh]

The problem was pop3 access from another computer without leaving e-mail copies for more than 5 days. Sadly, I didnt find any register of message deletion.

Is there any way to enable this kind of log?
How can I change the log format?

Regards,
Tilinho

[jholder]

Try /opt/zimbra/log/audit.log

May I mark this thread as solved?

[tilinhonh]

Try /opt/zimbra/log/audit.log

It shoes the access but it doesn't show whether the message was removed or not. About the log format, I'll try to find it out asap. Lately I haven't had much time :S

A few time ago (before updating) an user was downloading someone else emails via pop3. I only descovered that because the emails were desapearing in the IMAP box of the real owner. I went through /opt/zimbra/log/zimbra.log and bingo! There was the answer. If it happends today I have no clues about who the guilty is.