On 16/5/2025 10:28 μ.μ., Arkadiusz Miśkiewicz via dovecot wrote:
deliver_log_format = msgid=%m, storage_id=%{storage_id}
so you will know file name for stored email and then
inotifywatch to recursively monitor maildir. You will know what deletes that file and you could focus on debugging that.
Thank you for the hint.
Could you suggest a specific setup to run inotifywatch or inotifywait as a service and monitor the whole of /home/vmail for file deletions in a way that both the deleted filename and the deleting process are logged?
It seems that inotifywait cannot identify the deleting process because it operates at the filesystem level and doesn’t have insight into process/user metadata.
I have seen suggestions to use inotifywait and auditd combined, but setups are not that straightforward. Moreover, I think that the number of file events/deletions is probably large so we might end up in huge log files.
Please advise!
Thanks, Nick