How to Identify who deleted the mails from mailbox

[Caterpillar]

Hello,

We have shared email address info@domain.com that mailbox is accessed selected employess. Today morning someone has deleted the mails from that mailbox. A copy will be kept in the server.

1. How do I identify who has deleted the mails.

2. How to identify who has deleted the mails.

Please help me with this issue.. Waiting for reply...

Regards
Caterpillar

[bartounet]

looking the logs, /opt/zimbra/log/mailbox.log...

[sglewis]

Look in /opt/zimbra/logs/mailbox.log as bartounet states. Here's a sample entry, so you can search for what you are looking for:

2010-10-19 14:47:40,537 INFO [btpool0-19://hostname.com/service/soap/MsgActionRequest] [name=email@hostname.com;mid=538;ip=xxx.xxx.xxx.xxx ;ua=ZimbraWebClient - FF3.0 (Win)/6.0.8_GA_2661;] mailop - moving Message (id=18850) to Folder Trash (id=3)

I've changed the hostname, and email address, and x'ed out the IP, but basically you're looking for this line.