Question can i see who deleted mails?

[pauls1919]

Server operating system version

CloudLinux 8.4 x86_64

Plesk version and microupdate number

Plesk Obsidian 18.0.44.3

My client is complaining about mails being deleted after 14 days. Can i see on some logs what ip or device deletes mails?

 

[Maarten]

Most likely, your client is using POP3 to fetch the mails, and in the email client, there is a POP3 setting to delete mails after 14 days.

 

[pauls1919]

Most likely, your client is using POP3 to fetch the mails, and in the email client, there is a POP3 setting to delete mails after 14 days.

i thought about it but on what log is mentioned from what ip mails were deleted? so i can show customer that he deleted them.

 

[Monty]

By default, Dovecot does not log mail operations (move, delete etc.).
But it is possible to log those things using the mail logger plugin of Dovecot:

Mail logger plugin — Dovecot documentation

You can create your custom Dovecot configuration as explained here:
Customized Dovecot configuration file /etc/dovecot/dovecot.conf is overwritten after Plesk updates - Support Cases from Plesk Knowledge Base

Example file: /etc/dovecot/conf.d/99-custom-logging.conf:

# Enable the plugin globally for all services
mail_plugins = $mail_plugins notify mail_log

plugin {
  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
  mail_log_fields = uid box msgid size from
}

Then restart or reload dovecot.

Disclaimer: Do this at your own risk!