z3d3m0n

Active Member
Feb 8, 2016
32
1
8
Prague
cPanel Access Level
Root Administrator
Hello Guys,

user is claiming emails has been deleted from inbox , is there any log that could reflect some truth about what has happend ?

thanks in advance
 

bloatedstoat

Well-Known Member
Jun 14, 2012
150
18
18
Victoria, Australia
cPanel Access Level
Root Administrator
Hello @z3d3m0n

Have you asked if the user has the email account set up on more than one device?

I've had this issue presented in the past. The user set up their email (POP3) on several devices. One of those devices downloaded email from the server, once downloaded the mail was deleted from the server, the user then complained it was no longer available on another device.
 

z3d3m0n

Active Member
Feb 8, 2016
32
1
8
Prague
cPanel Access Level
Root Administrator
the user is using mainly webmail but there is a chance that he has pulled all emails via pop3 , is there any place in logs that shows that user has pulled emails via pop3?

thx
 

bloatedstoat

Well-Known Member
Jun 14, 2012
150
18
18
Victoria, Australia
cPanel Access Level
Root Administrator
The maillog shows protocol logins (imap and pop3) via dovecot.

You could issue on the command line, assuming you have root access to the server and search for instances of pop3 logins:

cat /var/log/maillog | grep [email protected] and see if that is the case.

That said, it does not "prove" that mail was retrieved and then removed, perhaps someone else on the list can chip and offer advice on that.
 

cPanelMichael

Technical Support Community Manager
Staff member
Apr 11, 2011
47,910
2,233
363
cPanel Access Level
DataCenter Provider
Twitter
Hello,

The information in the previous post is correct in that you can search /var/log/maillog to see if there was any POP3 activity on the email account. This is the most common reason that email is removed from Webmail, as most POP3 email clients will not automatically keep a copy of the messages stored on the server.

Thank you.
 

cPanelMichael

Technical Support Community Manager
Staff member
Apr 11, 2011
47,910
2,233
363
cPanel Access Level
DataCenter Provider
Twitter
i checked the log and i see only imap- logins and connections , no pop3. any other clues ?
You can also search /usr/local/cpanel/logs/access_log for the email address or cPanel account username to see if another IP address (other than the one utilized by the account holder) logged in via cPanel or Webmail to perform actions. For example, to search for test1 @ domain.com, you'd use a command like this:

Code:
grep test1%40domain.com /usr/local/cpanel/logs/access_log
Thank you.