Results 1 to 2 of 2

Thread: How to tell if an admin has read a message from someones archive - mailbox.log?

  1. #1
    Shane Herman is offline Starter Member
    Join Date
    Feb 2013
    Posts
    1
    Rep Power
    2

    Question How to tell if an admin has read a message from someones archive - mailbox.log?

    Hi,

    I need to know if there is a way that I can tell if one of my admins has accessed read an email from one of our executive's archive account. I've been reading through the "mailbox.log" and I can see that he accessed her archives, but I need to know which message he has opened or read. It doesn't appear that I can link any entry in the mailbox.log file to a particular message.

    Is there something I'm missing? Is there a better log file I should check out? Any help would be appreciated as this man's job is at risk.

    Thanks!

    Shane

  2. #2
    Rich Graves is offline Outstanding Member
    Join Date
    Jan 2007
    Location
    Minnesota
    Posts
    719
    Rep Power
    9

    Default

    Sorry to hear that such an accusation is in play. Not fun for anyone.

    log/access_log.2013-(current date) is the web server log. It won't tell you what message was read (unless they used the "Standard HTML," "Mobile," or "Print View" clients, which is unlikely), but it will give you a slightly better idea how active they were.

    As you've seen, message deletions are recorded, but reads are not (unless you have played with Log Files - Zimbra :: Wiki which you cannot do retroactively).

    Oh! If the snooper changed the message's read/unread flags, and if no later event changed any flag, then the timestamp would be recorded in the mail_item table. You're going to need to spend a fair amount of time reading wiki articles to figure out how to trace an account to a mboxgroup and mailbox_id, and then select the row for the mail_item_it. Good luck.

    Note that it's certainly possible to see a message by accident while doing legitimate work. Some pane layouts have the effect of auto-opening the most recent message, after all. If he had no business being in the account at all, and you're just assessing how bad the damage was, then again, good luck and make sure you (not just the exec) call the lawyers first.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. ZCS reading pane message clears- unable to read message
    By rcilink in forum Administrators
    Replies: 6
    Last Post: 11-10-2013, 04:28 PM
  2. How to archive Old message on MailArchiva
    By blason in forum Administrators
    Replies: 1
    Last Post: 12-08-2011, 12:37 AM
  3. Virus not blocked in archive mailbox
    By tvtsg in forum Administrators
    Replies: 3
    Last Post: 09-23-2011, 12:26 PM
  4. Replies: 0
    Last Post: 05-15-2008, 02:09 AM
  5. archive mailbox on OpenSource edition
    By Artturi in forum Administrators
    Replies: 0
    Last Post: 09-08-2007, 04:47 AM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •