Restoring part of a backup

[buee]

I'm using ZCS 5.0.16 open source on CentOS and I have made a script that will backup and tar the /opt/zimbra folder every week.

I have a problem user on my Zimbra server and her latest gripe is that Zimbra magically deleted a whole months worth of e-mails. The other 20 active e-mail accounts have not reported this. I guess there are two parts to my question:

1) Is there a way to restore that backup so that she gets the missing months e-mails back without creating duplicates and without deleting anything that's been received since (on any accounts)?

2) Is there something specific I can look for in the logs to tell exactly what happened to those e-mails? I am somewhat of a Zimbra n00b and I would need to know which log to look at and what to look for.

My guess is that it's an ID10T error but still, I want to know what happened exactly.

[phoenix]

If you have a backup of the store directory then you can use zmlmtpinject to put the records back into the mailbox. There are usually a couple of reasons mail goes 'missing' a) there's a filter that deletes mail b) there's been a connection using a POP3 client and the more likely c) the user actually deletes the mail themselves. Other than that and without log files it's almost impossible to tell you exactly what happened.

[buee]

Originally Posted by phoenix

If you have a backup of the store directory then you can use zmlmtpinject to put the records back into the mailbox. There are usually a couple of reasons mail goes 'missing' a) there's a filter that deletes mail b) there's been a connection using a POP3 client and the more likely c) the user actually deletes the mail themselves. Other than that and without log files it's almost impossible to tell you exactly what happened.

I have not checked in to A yet, but I would be surprised if that were the case as the mail that is "missing" is from a specific date to a specific date. B is plausible, but I went in to that user's account in Windows Mail and set it to retain the messages on the server indefinitely and advised that person to not touch those settings. C is probably the most likely cause and this woman is just a ************************* (replace asterisks by every derogatory comment you can think of) and due to the fact that she's not a nice person, I would like to check the logs to see if she deleted the mail manually and show that to the guy that pays the bills and see what he has to say. I've got 20 other users on the Zimbra server and aside from a glitch with IE8, NO ONE else has complained besides this person. I would really like to shut them up for good. Any indication of where the log file might be?

[buee]

Originally Posted by phoenix

If you have a backup of the store directory then you can use zmlmtpinject to put the records back into the mailbox. There are usually a couple of reasons mail goes 'missing' a) there's a filter that deletes mail b) there's been a connection using a POP3 client and the more likely c) the user actually deletes the mail themselves. Other than that and without log files it's almost impossible to tell you exactly what happened.

Is there a way to use Rsync so that it won't create duplicates and won't delete anything received since perhaps? Seems logical as it's in the script for the backup, why couldn't I just do it in reverse?

[bdial]

the messages in the store directory by themselves aren't enough, there is data about them in the mysql database as well. this is why you can't just rsync because if the messages are there but not the associated data in the db they will not show up in zimbra.

[buee]

Originally Posted by bdial

the messages in the store directory by themselves aren't enough, there is data about them in the mysql database as well. this is why you can't just rsync because if the messages are there but not the associated data in the db they will not show up in zimbra.

I'm doing the entire /opt/zimbra folder, won't that get the DB?

[bdial]

that'd be fine if you wanted to whole sale replace the db but then you'd be wiping out all the entries since the incident.

[Rich Graves]

Re your original question 2: yes, starting several versions ago, mailbox.log has clearly shown when messages were deleted, but you only get the user, ip, folder, and message #. In theory, this could be correlated with an old msqldump or the "Adding message" log entry upon receipt.

In practice, you're probably best off finding the user's store directory (there's a good wiki article on the message store layout), grepping backed-up messages, and lmptinjecting them.

Don't forget to search first. In about 50% of my "lost message" cases, the message is still in inbox. 30% in Trash. I teach people not to empty trash, but to let the 30-day auto-purge deal with it. Disk space is cheaper than our time, and since your backups are discoverable anyway, I don't see that saving trash adds legal risk.

[buee]

Originally Posted by Rich Graves

Re your original question 2: yes, starting several versions ago, mailbox.log has clearly shown when messages were deleted, but you only get the user, ip, folder, and message #. In theory, this could be correlated with an old msqldump or the "Adding message" log entry upon receipt.

In practice, you're probably best off finding the user's store directory (there's a good wiki article on the message store layout), grepping backed-up messages, and lmptinjecting them.

Don't forget to search first. In about 50% of my "lost message" cases, the message is still in inbox. 30% in Trash. I teach people not to empty trash, but to let the 30-day auto-purge deal with it. Disk space is cheaper than our time, and since your backups are discoverable anyway, I don't see that saving trash adds legal risk.

Right now, I'm using the open source edition so the backups are somewhat "ghetto". Using rsync, I sync /opt/zimbra over, shut down Zimbra, rsync again, start Zimbra, tar the files. I'm told that the lmtpinject method will not work with that backup method. Can anyone confirm or deny this?

[Rich Graves]

I think bdial missed or misunderstood the use of lmtpinject. It is true that finding and restoring the files in /opt/zimbra/store is not sufficient. They need to be imported via rest or lmtp. lmtpinject does literally the same thing as a new incoming email (post-antivirus and antispam checks).

If the user cares about the "Received" date being correct, you might have to get a little fancy with an x-zimbra-received header.