Hello,

We are on Dovecot 2.3.18.

Some users are occasionally complaining that all mail vanishes from their inbox.

However, we cannot find any indication of deletions or expunge in the log.

One explanation could be that mail files are deleted externally (at the file system level), but I can't imagine what could cause such deletions.

How would you suggest us to troubleshoot this further?

We could enable "mail_debug = yes", but this would flood the logs and cause performance drop, and the issue is happening rarely.

Any other ideas to troubleshoot these cases in the past (through logs) or monitor (whatever) for the future?

(The config is listed at the end.)

Thanks in advance.

Best regards, Nick

The config follows:

=======================================================================

protocols = imap pop3 sieve lmtp

login_greeting = Dovecot OUR ORG

log_path = /var/log/dove.log

mail_location = maildir:~/Maildir/

mail_gid = 500
mail_uid = 500

auth_mechanisms = plain login
auth_username_format = %Ln

auth_verbose = no
auth_debug = no
mail_debug = no

disable_plaintext_auth = no

mail_plugins = quota mail_log notify

protocol imap {
   imap_client_workarounds = "delay-newmail"
   mail_plugins = quota imap_quota mail_log notify
   mail_max_userip_connections = 400

   namespace inbox {
    mailbox Trash {
     autoexpunge = 15d
    }
   }
}

protocol pop3 {
   mail_max_userip_connections = 3
   mail_plugins = quota notify
   pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
   pop3_uidl_format = %08Xu%08Xv

   namespace inbox {
    mailbox Trash {
     autoexpunge = 15d
    }
   }
}

protocol lda {
   auth_socket_path = /var/run/dovecot/auth-master
   mail_plugins = quota notify sieve
   postmaster_address = sysadmin@noa.gr
   sendmail_path = /usr/lib/sendmail
}

protocol lmtp {
   auth_socket_path = /var/run/dovecot/auth-master
   postmaster_address = sysadmin@noa.gr
   mail_plugins = quota notify sieve
   sendmail_path = /usr/lib/sendmail
}

protocol sieve {
   managesieve_max_line_length = 65536
   mail_max_userip_connections = 10
   managesieve_logout_format = bytes=%i/%o
   managesieve_max_compile_errors = 10
}

userdb {
   args = /etc/dovecot/dovecot-usrdb-ldap.conf
   driver = ldap
}

passdb {
   args = /etc/dovecot/dovecot-passdb-ldap.conf
   driver = ldap
}

plugin {
   mail_log_events = delete undelete expunge copy mailbox_delete
mailbox_rename flag_change save mailbox_create
   mail_log_fields = uid box msgid size flags vsize from subject

   quota = maildir:User quota
   quota_rule = *:storage=15G
   quota_rule2 = Trash:storage=+3%%
   quota_warning = storage=75%% quota-warning 75 %u
   quota_warning2 = storage=90%% quota-warning 90 %u

   # Used by both the Sieve plugin and the ManageSieve protocol
   sieve = file:~/sieve;active=~/.dovecot.sieve
   sieve_max_script_size = 0
   sieve_max_actions = 0
   sieve_max_redirects = 2
}

service quota-warning {
   executable = script /opt/mail1.sh
   user = vmail
   unix_listener quota-warning {
     user = vmail
   }
}

service auth {
   unix_listener /var/spool/postfix/private/auth {
     group = postfix
     mode = 0660
     user = postfix
   }
   unix_listener auth-master {
     group = vmail
     mode = 0660
     user = vmail
   }
   user = root
}

service imap-login {
   service_count = 100
   vsz_limit = 64 M
   process_limit = 500
}

service pop3-login {
   service_count = 100
   vsz_limit = 64 M
}

service managesieve-login {
   inet_listener sieve {
     port = 4190
   }

   service_count = 100
   process_min_avail = 0
   vsz_limit = 64M
}

service managesieve {
   process_limit = 1024
}

service imap {
   executable = imap postlogin
   process_limit = 2048
}

service pop3 {
   executable = pop3 postlogin
}

service postlogin {
   executable = script-login -d rawlog
   unix_listener postlogin {
   }
}

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
   }
}

ssl = yes
ssl_cert = </etc/pki/tls/certs/servercert.crt
ssl_key = </etc/pki/tls/private/serverkey.key

namespace inbox {

   separator = .
   prefix =
   inbox = yes

   mailbox Drafts {
     special_use = \Drafts
     auto = subscribe
   }
   mailbox Junk {
     special_use = \Junk
     auto = subscribe
   }
   mailbox Trash {
     special_use = \Trash
     auto = subscribe
   }
   mailbox Sent {
     special_use = \Sent
     auto = subscribe
   }
}

=======================================================================

Hello, We are on Dovecot 2.3.18. Some users are occasionally complaining that all mail vanishes from their inbox. However, we cannot find any indication of deletions or expunge in the log.  One explanation could be that mail files are deleted externally (at the file system level), but I can't imagine what could cause such deletions. How would you suggest us to troubleshoot this further? We could enable "mail_debug = yes", but this would flood the logs and cause performance drop, and the issue is happening rarely. Any other ideas to troubleshoot these cases in the past (through logs) or monitor (whatever) for the future? (The config is listed at the end.) Thanks in advance. Best regards, Nick The config follows:

 protocols = imap pop3 sieve lmtp

 login_greeting = Dovecot OUR ORG

 log_path = /var/log/dove.log

 mail_location = maildir:~/Maildir/

 mail_gid = 500
 mail_uid = 500

 auth_mechanisms = plain login
 auth_username_format = %Ln

 auth_verbose = no
 auth_debug = no
 mail_debug = no

 disable_plaintext_auth = no

 mail_plugins = quota mail_log notify

 protocol imap {
   imap_client_workarounds = "delay-newmail"
   mail_plugins = quota imap_quota mail_log notify
   mail_max_userip_connections = 400

   namespace inbox {
    mailbox Trash {
     autoexpunge = 15d
    }
   }
 }

 protocol pop3 {
   mail_max_userip_connections = 3
   mail_plugins = quota notify
   pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
   pop3_uidl_format = %08Xu%08Xv

   namespace inbox {
    mailbox Trash {
     autoexpunge = 15d
    }
   }
 }

 protocol lda {
   auth_socket_path = /var/run/dovecot/auth-master
   mail_plugins = quota notify sieve
   postmaster_address = sysadmin@noa.gr
   sendmail_path = /usr/lib/sendmail
 }

 protocol lmtp {
   auth_socket_path = /var/run/dovecot/auth-master
   postmaster_address = sysadmin@noa.gr
   mail_plugins = quota notify sieve
   sendmail_path = /usr/lib/sendmail
 }

 protocol sieve {
   managesieve_max_line_length = 65536
   mail_max_userip_connections = 10
   managesieve_logout_format = bytes=%i/%o
   managesieve_max_compile_errors = 10
 }

 userdb {
   args = /etc/dovecot/dovecot-usrdb-ldap.conf
   driver = ldap
 }

 passdb {
   args = /etc/dovecot/dovecot-passdb-ldap.conf
   driver = ldap
 }

 plugin {
   mail_log_events = delete undelete expunge copy mailbox_delete
 mailbox_rename flag_change save mailbox_create
   mail_log_fields = uid box msgid size flags vsize from subject

   quota = maildir:User quota
   quota_rule = *:storage=15G
   quota_rule2 = Trash:storage=+3%%
   quota_warning = storage=75%% quota-warning 75 %u
   quota_warning2 = storage=90%% quota-warning 90 %u

   # Used by both the Sieve plugin and the ManageSieve protocol
   sieve = file:~/sieve;active=~/.dovecot.sieve
   sieve_max_script_size = 0
   sieve_max_actions = 0
   sieve_max_redirects = 2
 }

 service quota-warning {
   executable = script /opt/mail1.sh
   user = vmail
   unix_listener quota-warning {
     user = vmail
   }
 }

 service auth {
   unix_listener /var/spool/postfix/private/auth {
     group = postfix
     mode = 0660
     user = postfix
   }
   unix_listener auth-master {
     group = vmail
     mode = 0660
     user = vmail
   }
   user = root
 }

 service imap-login {
   service_count = 100
   vsz_limit = 64 M
   process_limit = 500
 }

 service pop3-login {
   service_count = 100
   vsz_limit = 64 M
 }

 service managesieve-login {
   inet_listener sieve {
     port = 4190
   }

   service_count = 100
   process_min_avail = 0
   vsz_limit = 64M
 }

 service managesieve {
   process_limit = 1024
 }

 service imap {
   executable = imap postlogin
   process_limit = 2048
 }

 service pop3 {
   executable = pop3 postlogin
 }

 service postlogin {
   executable = script-login -d rawlog
   unix_listener postlogin {
   }
 }

 service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
   }
 }

 ssl = yes
 ssl_cert = </etc/pki/tls/certs/servercert.crt
 ssl_key = </etc/pki/tls/private/serverkey.key

 namespace inbox {

   separator = .
   prefix =
   inbox = yes

   mailbox Drafts {
     special_use = \Drafts
     auto = subscribe
   }
   mailbox Junk {
     special_use = \Junk
     auto = subscribe
   }
   mailbox Trash {
     special_use = \Trash
     auto = subscribe
   }
   mailbox Sent {
     special_use = \Sent
     auto = subscribe
   }
 }

=======================================================================