Intermittent, Automatic Moves to Trash

tco_jonathan

Registered
Dec 30, 2018
3
0
1
Dallas TX
cPanel Access Level
Root Administrator
Hi All,

I've been searching, off and on, for months trying to figure out what's going on, but I'm lost and hope you can help.

Intermittently, emails are move from my Inbox upon receipt into the server's Trash folder. I specify the "server's" Trash folder because it doesn't appear in my email client (Outlook) on any of my devices (tablet, phone, desktop). I literally have to log into RoundCube to view the deleted messages and move them back to the Inbox. In terms of frequency, this happens at least once a week.

I've checked the logs and can find nothing to explain this. I can find no explanation for the move. And it's entirely inconsistent. It happens with messages from multiple domains, hosts, content. Sometimes new messages, sometimes messages in the middle of a thread.

My first thought was a spam filter, but I turned off SpamAssassin entirely to check, and it wasn't that.

Some details:
CentOS 7.5
WHM/cPanel v76.0.14

Any advice, hints, tips, or points in the right direction would be very much appreciated.

Thank you,

Jonathan
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,296
1,271
313
Houston
Hi @tco_jonathan


I think the best course of action would be to enable dovecot's more detailed logging. This only requires a couple of changes but to make it easier I created a bash script for you to be run as root:

1.
Code:
touch more_dovecot_logs
2. Add the following to more_dovecot_logs:
Code:
#!/bin/sh
cd /var/cpanel/templates/dovecot2.2
cp main.default main.local
sed -i '677i mail_plugins = $mail_plugins mail_log notify' main.local
sed -i '746i plugin { \
  # Events TWEET available to log: append copy delete expunge flag_change mailbox_delete mailbox_rename undelete \
  mail_log_events = append copy delete expunge flag_change mailbox_delete mailbox_rename undelete \
  # Available fields: uid, box, msgid, from, subject, size, vsize, flags \
  # size and vsize are available only for expunge and copy events. \
  mail_log_fields = uid box msgid size subject flags \
}' main.local
/scripts/builddovecotconf
/scripts/restartsrv_dovecot
Keep in mind the sed here correlates to the line number to enter the information into - it could be slightly different but this worked for me
3.
Code:
chmod +x more_dovecot_logs
4. run the script
Code:
./more_dovecot_logs

Once that's done dovecot will begin logging much more detailed information to
Code:
/var/log/maillog
including any time a message is moved from one folder to another. It might be a good starting point to finding out what is going on. When the issue occurs again you can see exactly what happened.
 
Last edited:

tco_jonathan

Registered
Dec 30, 2018
3
0
1
Dallas TX
cPanel Access Level
Root Administrator
Hi @cPanelLauren

Thank you for your detailed advice. I executed everything you suggested and waited. This morning it happened again, finally. (Or, rather, I noticed it happening again).

Here's the log for the time in question:

Code:
Jan 12 08:02:29 server dovecot: lmtp(26797): Connect from local
Jan 12 08:02:29 server dovecot: lmtp([email protected]): msgid=<[email protected]>: saved mail to INBOX
Jan 12 08:02:29 server dovecot: lmtp(26797): Disconnect from local: Successful quit
I read the log going back and forward by 10 minutes and saw nothing else of note.