track unauthorized account modification

[eaperezh]

Today we received a report from a user that he claims he never set up the mail forwarding option on his zimbra web account.
In zimbra 5.x is there any way to "view" or search the log of a user mailbox and see when this email address was added to the forwarding section in this user email account?

thanks,

[veronica]

Depends of you still preserve the old logs or if user set it recently. logs get purged by default every week. If you have logs search mailbox.log

[eaperezh]

what should i search?

[dljordaneku]

There is a way to do it from CLI but I can't find the script I had to do it. I bet there are some CLI gurus in here that can recreate it. We had a problem one time with someone's account being hacked and being used for spam. The spammer had set up a forwarding address in the account so they would get all of the replies. I was able to run the script to see if any other accounts had been hacked.


dj