missing emails

[Sruli Saurymper]

Hi All,

I have an interesting issue, 1 of my clients is complaining that some
emails do not come through to their mail client (thunderbird) and also
do not show on Roundcube but they do see it when viewing their emails
with "Mailwasher" (it's a mail filter application).

I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.

Any ideas on how I can trouble shoot this issue?

Many thanks

Sruli

[hede]

Post by Sruli Saurymper
I have an interesting issue, 1 of my clients is complaining that some
emails do not come through to their mail client (thunderbird) and also
do not show on Roundcube but they do see it when viewing their emails
with "Mailwasher" (it's a mail filter application).
I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.

did your client sort its mails by date? maybe it's a date issue. some mail programs use the envelope date, others use various "date" headers.

I've seen this effect with some spam mails with faked date headers. on some mail programs I've found affected mails at the top of the list but with others they vanished - couldn't find them. it turns out some mail headers containing a date were far in the future/past and the mail was put far away from the place I did expected them to be.

regards
hede

[Sruli Saurymper]

Post by Sruli Saurymper
I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.

You could check it via telnet / openssl s_client.
openssl s_client -crlf -connect imapserver.example.com:993
A login imapuser imappassword
B select INBOX
C UID SEARCH FROM "somebody"
-> check if your mail is found
D fetch 123 rfc822.header
-> if it's mail #123, then check if it's readable
E logout
Maybe it's marked as deleted (for examble by a spam filter like mailwasher) so thunderbird and roundcube won't show it.
Or the cyrus-, thunderbird- and/or roundcube databases are corrupted - there are a ways to fix this.
(
thunderbird: rebuild imap tree by rebuilding the global database.
)
I'm just guessing - I don't have any real clue...

Couldn't fetch any headers but the search found 6 emails, I have 6 in
the Inbox, so it did not find the one in question.
How can I check if a email has DELETED flag?

regards
hede

[Liutauras Adomaitis]

Post by Sruli Saurymper

Am Sun, 3 Sep 2017 10:40:03 +0100 schrieb Sruli Saurymper

Post by Sruli Saurymper
I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.

You could check it via telnet / openssl s_client.
openssl s_client -crlf -connect imapserver.example.com:993
A login imapuser imappassword
B select INBOX
C UID SEARCH FROM "somebody"
-> check if your mail is found
D fetch 123 rfc822.header
-> if it's mail #123, then check if it's readable
E logout
Maybe it's marked as deleted (for examble by a spam filter like
mailwasher) so thunderbird and roundcube won't show it. Or the cyrus-,
thunderbird- and/or roundcube databases are corrupted - there are a ways
to fix this. (
thunderbird: rebuild imap tree by rebuilding the global database.
cyrus: "su - cyrus; /usr/lib/cyrus-imapd/reconstruct -r
)
I'm just guessing - I don't have any real clue...

Couldn't fetch any headers but the search found 6 emails, I have 6 in
the Inbox, so it did not find the one in question.
How can I check if a email has DELETED flag?

You can use:
/usr/lib/cyrus-imapd/cyrdump <mailbox> | less
command to dump mailbox. That should also have a list of messages with deleted
flag.
/usr/lib/cyrus-imapd/unexpunge -l <mailbox>
command should show the list of email which are expunged from the mailbox, but
still available for recovery. Unlike as with /deleted flag, the recovery of
expunged emails can be done by Cyrus IMAP addministrator from console only.
Messages expunged from mailbox are not accessible for user via IMAP in any
way.

Liutauras

[Sruli Saurymper]

Post by Liutauras Adomaitis

Post by Sruli Saurymper

Am Sun, 3 Sep 2017 10:40:03 +0100 schrieb Sruli Saurymper

Post by Sruli Saurymper
I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.

You could check it via telnet / openssl s_client.
openssl s_client -crlf -connect imapserver.example.com:993
A login imapuser imappassword
B select INBOX
C UID SEARCH FROM "somebody"
-> check if your mail is found
D fetch 123 rfc822.header
-> if it's mail #123, then check if it's readable
E logout
Maybe it's marked as deleted (for examble by a spam filter like
mailwasher) so thunderbird and roundcube won't show it. Or the cyrus-,
thunderbird- and/or roundcube databases are corrupted - there are a ways
to fix this. (
thunderbird: rebuild imap tree by rebuilding the global database.
cyrus: "su - cyrus; /usr/lib/cyrus-imapd/reconstruct -r
)
I'm just guessing - I don't have any real clue...

Couldn't fetch any headers but the search found 6 emails, I have 6 in
the Inbox, so it did not find the one in question.
How can I check if a email has DELETED flag?

/usr/lib/cyrus-imapd/cyrdump <mailbox> | less
command to dump mailbox. That should also have a list of messages with deleted
flag.
/usr/lib/cyrus-imapd/unexpunge -l <mailbox>
command should show the list of email which are expunged from the mailbox, but
still available for recovery. Unlike as with /deleted flag, the recovery of
expunged emails can be done by Cyrus IMAP addministrator from console only.
Messages expunged from mailbox are not accessible for user via IMAP in any
way.
Liutauras

Thanks, /usr/lib/cyrus-imapd/unexpunge -l <mailbox> did show that they
are expunged.
However you wrote that expunged email are only recoverable by console, I
wonder how the MailWasher application can read it.
Most importantly how / where can I see in the logs the full trail of how
/ who deleted / expunged the email?

Many thanks
Sruli

Post by Liutauras Adomaitis
_______________________________________________
users mailing list
https://lists.kolab.org/mailman/listinfo/users

[Sruli Saurymper]

Post by Sruli Saurymper

Post by Liutauras Adomaitis

Post by Sruli Saurymper

Am Sun, 3 Sep 2017 10:40:03 +0100 schrieb Sruli Saurymper

Post by Sruli Saurymper
I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.

You could check it via telnet / openssl s_client.
openssl s_client -crlf -connect imapserver.example.com:993
A login imapuser imappassword
B select INBOX
C UID SEARCH FROM "somebody"
-> check if your mail is found
D fetch 123 rfc822.header
-> if it's mail #123, then check if it's readable
E logout
Maybe it's marked as deleted (for examble by a spam filter like
mailwasher) so thunderbird and roundcube won't show it. Or the cyrus-,
thunderbird- and/or roundcube databases are corrupted - there are a ways
to fix this. (
thunderbird: rebuild imap tree by rebuilding the global database.
cyrus: "su - cyrus; /usr/lib/cyrus-imapd/reconstruct -r
)
I'm just guessing - I don't have any real clue...

Couldn't fetch any headers but the search found 6 emails, I have 6 in
the Inbox, so it did not find the one in question.
How can I check if a email has DELETED flag?

/usr/lib/cyrus-imapd/cyrdump <mailbox> | less
command to dump mailbox. That should also have a list of messages with deleted
flag.
/usr/lib/cyrus-imapd/unexpunge -l <mailbox>
command should show the list of email which are expunged from the mailbox, but
still available for recovery. Unlike as with /deleted flag, the recovery of
expunged emails can be done by Cyrus IMAP addministrator from console only.
Messages expunged from mailbox are not accessible for user via IMAP in any
way.
Liutauras

Thanks, /usr/lib/cyrus-imapd/unexpunge -l <mailbox> did show that they
are expunged.
However you wrote that expunged email are only recoverable by console,
I wonder how the MailWasher application can read it.

I was mistaken, mailwasher does NOT display the expunged emails, I still
need to know how to find who/when deletes/expunges the emails, how do I
find that?

Post by Sruli Saurymper
Most importantly how / where can I see in the logs the full trail of
how / who deleted / expunged the email?
Many thanks
Sruli

Post by Liutauras Adomaitis
_______________________________________________
users mailing list
https://lists.kolab.org/mailman/listinfo/users

_______________________________________________
users mailing list
https://lists.kolab.org/mailman/listinfo/users

[Liutauras Adomaitis]

Post by Sruli Saurymper

Post by Liutauras Adomaitis

Post by Sruli Saurymper

Am Sun, 3 Sep 2017 10:40:03 +0100 schrieb Sruli Saurymper

Post by Sruli Saurymper
I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.

You could check it via telnet / openssl s_client.
openssl s_client -crlf -connect imapserver.example.com:993
A login imapuser imappassword
B select INBOX
C UID SEARCH FROM "somebody"
-> check if your mail is found
D fetch 123 rfc822.header
-> if it's mail #123, then check if it's readable
E logout
Maybe it's marked as deleted (for examble by a spam filter like
mailwasher) so thunderbird and roundcube won't show it. Or the cyrus-,
thunderbird- and/or roundcube databases are corrupted - there are a ways
to fix this. (
thunderbird: rebuild imap tree by rebuilding the global database.
cyrus: "su - cyrus; /usr/lib/cyrus-imapd/reconstruct -r
)
I'm just guessing - I don't have any real clue...

Couldn't fetch any headers but the search found 6 emails, I have 6 in
the Inbox, so it did not find the one in question.
How can I check if a email has DELETED flag?

/usr/lib/cyrus-imapd/cyrdump <mailbox> | less
command to dump mailbox. That should also have a list of messages with
deleted flag.
/usr/lib/cyrus-imapd/unexpunge -l <mailbox>
command should show the list of email which are expunged from the mailbox,
but still available for recovery. Unlike as with /deleted flag, the
recovery of expunged emails can be done by Cyrus IMAP addministrator from
console only. Messages expunged from mailbox are not accessible for user
via IMAP in any way.
Liutauras

Thanks, /usr/lib/cyrus-imapd/unexpunge -l <mailbox> did show that they
are expunged.
However you wrote that expunged email are only recoverable by console, I
wonder how the MailWasher application can read it.
Most importantly how / where can I see in the logs the full trail of how
/ who deleted / expunged the email?
Many thanks
Sruli

Post by Liutauras Adomaitis
_______________________________________________
users mailing list
https://lists.kolab.org/mailman/listinfo/users

Finding information who deleted the email maybe tricky if at all possible.
In /var/log/maillog (on CentOS) you should be looking for lines containing
"Expunge" string. Try to match the mailbox the email was expunge from and the
information which get about expunged email with command /usr/lib/cyrus-imapd/
unexpunge (Expg date for example).
If you find the match you should be able to trace back Cyrus IMAP session and
it should contain some information about from which IP, what user created the
session during which the email was expunged. Also you have to have in mind
that if mail filters are running on client side, move message to other folder
on client side will look like message expunge.

I don't know what is "MailWasher".

Liutauras

[Stefan Froehlich]

After a recent update of Guam it was slowing down Thunderbird to open
mail Folders. Sometimes it was just taking longer than usual, sometimes
it was taking forever.
I restored contents of /opt/kolab_guam from a backup and now all is back
to normal.

Cheers,
Stefan Froehlich
42 ;-)

[Matthias Busch]

Yeah, unfortunately, its a known issue since July (see Guam broken in
Centos 7 <http://lists.kolab.org/pipermail/users/2017-July/021223.html>)

I recommend to stick with Guam 0.8.3 until the issue is resolved. It
will depend on your linux distribution on how to prevent updates to
update guam but it can be done.

Another possibility would be to not use guam (i.e. set cyrus to use the
pop3/imap ports and give guam other and unused ports) - this would cause
the Kolab folders to show up again like they did before in 3.x

And lets hope the issue will be resolved some day.

[Skale, Franz]

Hi,
and there's an open Task in the kolab git too.
Link: https://git.kolab.org/T2076

Rgds.
Franz

Post by Matthias Busch
Yeah, unfortunately, its a known issue since July (see Guam broken in
Centos 7 [1])
I recommend to stick with Guam 0.8.3 until the issue is resolved. It
will depend on your linux distribution on how to prevent updates to
update guam but it can be done.
Another possibility would be to not use guam (i.e. set cyrus to use
the pop3/imap ports and give guam other and unused ports) - this would
cause the Kolab folders to show up again like they did before in 3.x
And lets hope the issue will be resolved some day.
------
[1] http://lists.kolab.org/pipermail/users/2017-July/021223.html
_______________________________________________
users mailing list
https://lists.kolab.org/mailman/listinfo/users