Audit mail usage

[Robert Spencer]

I'm busy writing a script to audit a specific domains email usage.

I can see who the top bandwidth users, but noticed a discrepancy. In cPanel for the 3rd of February the entire domain used 471.23 MB via IMAP.

Yet in the logs:

# zgrep "^Feb  3" /var/log/maillog-20160207.gz | awk '/dovecot: imap/ && /example.com/ && /bytes=/ {print $NF}' | sed -e 's/bytes=//' -e 's/\// /' | awk '{sum+=$1+$2} END {print sum}'
2336787930

That's almost a 2GB difference.

Checking the 4th and there's about a 700MB difference with the logs being higher.

5th there's about a 800MB difference with the logs being higher.

What am I misunderstanding or is there something wrong?

 

[cPanelMichael]

Hello

This document sheds some light on why some bandwidth reporting utilities show different values than others:

Apparent Discrepancies in Bandwidth Usage Statistics - Documentation - cPanel Documentation

Thank you.