Intermittent, Automatic Moves to Trash

[tco_jonathan]

Hi All,

I've been searching, off and on, for months trying to figure out what's going on, but I'm lost and hope you can help.

Intermittently, emails are move from my Inbox upon receipt into the server's Trash folder. I specify the "server's" Trash folder because it doesn't appear in my email client (Outlook) on any of my devices (tablet, phone, desktop). I literally have to log into RoundCube to view the deleted messages and move them back to the Inbox. In terms of frequency, this happens at least once a week.

I've checked the logs and can find nothing to explain this. I can find no explanation for the move. And it's entirely inconsistent. It happens with messages from multiple domains, hosts, content. Sometimes new messages, sometimes messages in the middle of a thread.

My first thought was a spam filter, but I turned off SpamAssassin entirely to check, and it wasn't that.

Some details:
CentOS 7.5
WHM/cPanel v76.0.14

Any advice, hints, tips, or points in the right direction would be very much appreciated.

Thank you,

Jonathan

 

[tco_jonathan]

Silly me; should have read the guide beforehand:

/etc/redhat-release:
CentOS Linux release 7.5.1804 (Core)

/usr/local/cpanel/version:
11.76.0.14

/var/cpanel/envtype:
standard

 

[cPanelLauren]

Hi @tco_jonathan


I think the best course of action would be to enable dovecot's more detailed logging. This only requires a couple of changes but to make it easier I created a bash script for you to be run as root:

1.

touch more_dovecot_logs

2. Add the following to more_dovecot_logs:

#!/bin/sh
cd /var/cpanel/templates/dovecot2.2
cp main.default main.local
sed -i '677i mail_plugins = $mail_plugins mail_log notify' main.local
sed -i '746i plugin { \
  # Events TWEET available to log: append copy delete expunge flag_change mailbox_delete mailbox_rename undelete \
  mail_log_events = append copy delete expunge flag_change mailbox_delete mailbox_rename undelete \
  # Available fields: uid, box, msgid, from, subject, size, vsize, flags \
  # size and vsize are available only for expunge and copy events. \
  mail_log_fields = uid box msgid size subject flags \
}' main.local
/scripts/builddovecotconf
/scripts/restartsrv_dovecot

Keep in mind the sed here correlates to the line number to enter the information into - it could be slightly different but this worked for me
3.

chmod +x more_dovecot_logs

4. run the script

./more_dovecot_logs

Once that's done dovecot will begin logging much more detailed information to

/var/log/maillog

including any time a message is moved from one folder to another. It might be a good starting point to finding out what is going on. When the issue occurs again you can see exactly what happened.

 

[tco_jonathan]

Hi @cPanelLauren

Thank you for your detailed advice. I executed everything you suggested and waited. This morning it happened again, finally. (Or, rather, I noticed it happening again).

Here's the log for the time in question:

Jan 12 08:02:29 server dovecot: lmtp(26797): Connect from local
Jan 12 08:02:29 server dovecot: lmtp([email protected]): msgid=<[email protected]>: saved mail to INBOX
Jan 12 08:02:29 server dovecot: lmtp(26797): Disconnect from local: Successful quit

I read the log going back and forward by 10 minutes and saw nothing else of note.