audit / log

[sim]

Our users use both Thunderbird and web-client for mail clients.
We are using Version 5.0.16_GA_2921.RHEL5_64.FOSS Apr 29, 2009

I suspect that one of my users (or sysadmins) is reading someone elses mail. The user has complained about a "bug" that some read messages have changed back to unread.
His Inbox is not shared, so it would have to be either someone with his password is logging on or a sys admin is reading it using the web admin control panel and clicking View Mail.
Is there any way for me to figure this out? Is there something I can do so that if this happens in the future, I can check who or at what time his mail was accessed?

Thanks
Sim

[bdial]

grep "delegated access" /opt/zimbra/log/mailbox.log

that will show anytime osmeoone has used the view mail option from the admin interface

[abhiz]

ye from mailbox log you can find out from which IP mails are being accessed