Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

emails deleted from inbox

Discussion in 'E-mail Discussion' started by z3d3m0n, Aug 9, 2018.

  1. z3d3m0n

    z3d3m0n Member

    Joined:
    Feb 8, 2016
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Prague
    cPanel Access Level:
    Root Administrator
    Hello Guys,

    user is claiming emails has been deleted from inbox , is there any log that could reflect some truth about what has happend ?

    thanks in advance
     
  2. bloatedstoat

    bloatedstoat Well-Known Member

    Joined:
    Jun 14, 2012
    Messages:
    125
    Likes Received:
    11
    Trophy Points:
    18
    Location:
    Victoria, Australia
    cPanel Access Level:
    Root Administrator
    Hello @z3d3m0n

    Have you asked if the user has the email account set up on more than one device?

    I've had this issue presented in the past. The user set up their email (POP3) on several devices. One of those devices downloaded email from the server, once downloaded the mail was deleted from the server, the user then complained it was no longer available on another device.
     
  3. z3d3m0n

    z3d3m0n Member

    Joined:
    Feb 8, 2016
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Prague
    cPanel Access Level:
    Root Administrator
    the user is using mainly webmail but there is a chance that he has pulled all emails via pop3 , is there any place in logs that shows that user has pulled emails via pop3?

    thx
     
  4. bloatedstoat

    bloatedstoat Well-Known Member

    Joined:
    Jun 14, 2012
    Messages:
    125
    Likes Received:
    11
    Trophy Points:
    18
    Location:
    Victoria, Australia
    cPanel Access Level:
    Root Administrator
    The maillog shows protocol logins (imap and pop3) via dovecot.

    You could issue on the command line, assuming you have root access to the server and search for instances of pop3 logins:

    cat /var/log/maillog | grep user@domain.com and see if that is the case.

    That said, it does not "prove" that mail was retrieved and then removed, perhaps someone else on the list can chip and offer advice on that.
     
  5. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    The information in the previous post is correct in that you can search /var/log/maillog to see if there was any POP3 activity on the email account. This is the most common reason that email is removed from Webmail, as most POP3 email clients will not automatically keep a copy of the messages stored on the server.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. z3d3m0n

    z3d3m0n Member

    Joined:
    Feb 8, 2016
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Prague
    cPanel Access Level:
    Root Administrator
    Hello bloatedstoat ,
    and thank you for your tips i appreciate your help and time.
    i checked the log and i see only imap- logins and connections , no pop3. any other clues ?

    thx in advance
     
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,344
    Likes Received:
    1,852
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    You can also search /usr/local/cpanel/logs/access_log for the email address or cPanel account username to see if another IP address (other than the one utilized by the account holder) logged in via cPanel or Webmail to perform actions. For example, to search for test1 @ domain.com, you'd use a command like this:

    Code:
    grep test1%40domain.com /usr/local/cpanel/logs/access_log
    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice