Check if a user sent an email 6 weeks ago

[wazza]

Hi All

If I wanted to check if a user sent an email 6 weeks ago, what log file would I check?

[phoenix]

That assumes you still have the log files: Log Files - Zimbra :: Wiki

[wazza]

thanks for the link

/var/log/zimbra.log only has log for todays date 2nd June

I am still not able to find an email that the user sent 6 weeks ago. Am I looking in the right log file?

[phoenix]

You should find a set of rotated log files in the same that may contain the date.

[wazza]

Hi phoenix

I appreciate the help but if you are going to give help can you please explain in Lehmanns terms what needs to be done. I cannot fix the problem and decipher your reply.

[tiger2000]

you should check the log rotatation rule from :
1. /etc/logrotate.conf
2. su - zimbra ; crontab -e 5th/6th lines (zimbra user's crontab)

if you didn't change these setting, I guess you are not able to find the logs 6 weeks ago.


by the way, you can check /opt/zimbra/log/mailbox.log* files, when someone sent an email, you can get a record by doing a grep search:

grep "Sending message" mailbox.log*

[wazza]

Okay, I changed the log rotation to 10 weeks.

I have checked mailbox.log, no luck, nutta.

I am not sure what to do with this:
2. su - zimbra ; crontab -e 5th/6th lines (zimbra user's crontab)


Thanks for the help

[tiger2000]

> 2. su - zimbra ; crontab -e 5th/6th lines (zimbra user's crontab)


which means :
su - zimbra
crontab -e (and looks for 5th and 6th lines)

they're :

30 2 * * * find /opt/zimbra/log/ -type f -name \*.log\* -mtime +8 -exec rm {} \; > /dev/null 2>&1
35 2 * * * find /opt/zimbra/log/ -type f -name \*.out.???????????? -mtime +8 -exec rm {} \; > /dev/null 2>&1

see ? by default, it will just keep your /opt/zimbra/log/ files for recent 8 days.

Change the "8" to what you want.

hope you can get the log next time.

[wazza]

Thanks, I have changed the value in that line from 8 to 60. This should help in the future.

As for now, I really need to see if that user sent that email 6 weeks ago.

I have tried to restore the users account so that I can see if he sent the email in hos sent items. The problem is that every time I do a restore on the users accoutn, I do it "to a point in time" I used the date 27 April. The problem is that when this user account is restored it show email up to may 29? Why does it do this? I thought it would only restore mail up to 27 April and not go into May. I have done this several time to no avail. Am I doing something wrong?


All help appreciated.

[Jbrabander]

Are you restoring on top of the user's existing account? Try restoring to a "new" account. I think it offers to append the restored account's name to "restore_username".