Deleted emails question

[drdre]

Ok.. from the mailbox log file i can see what ip address deleted/move/etc messages.

But how can tie the IP address action to an email ?

For example :
29/08/2011 11:50:53,687 [name=records@chapmans.co.tt;mid=6;ip=192.168.10.10 4;ua=Yahoo! Zimbra Desktop/1.0_1593_Windows;] soap - MsgActionRequest
29/08/2011 11:50:53,691 [name=records@chapmans.co.tt;mid=6;ip=192.168.10.10 4;ua=Yahoo! Zimbra Desktop/1.0_1593_Windows;] mailop - moving Message (id=80130) to Folder Trash (id=3)

For instance we had a using using an old email client Zd1.0 and i they have been accidentally deleting emails..and i want to show them a log of the events... so i can see the deletes and moving to trash.. but how can i track it back to the exact email ? besides looking at the trash folder?

[deepblue]

Originally Posted by drdre

so i can see the deletes and moving to trash.. but how can i track it back to the exact email ? besides looking at the trash folder?

The mail in question has the id 80130. Grep all mailbox.log files for this id until you find an entry that indicates a mail being put into the users inbox.
That occurence shows the message-id of the mail...

Regards
Thomas