Large amount of hidden folders within /home/user/mail directory

[wintech2003]

Hello,

I'm trying to do a bit of clean up in a client's account (multiple addon domains, each addon domain has a few email addresses), and I can see a large number of hidden folders inside the /home/[username]/mail/ directory, which refer to usernames of email accounts, for example:

drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.cur
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-acl-list
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot_index_cache
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot_index_log
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-uidlist
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-uidvalidity
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-uidvalidity_51f62b77
drwxr-x--x    3 username username     4096 Nov  4  2017 domain.com
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.maildirsize
drwxr-x--x    3 username username     4096 Nov  4  2017 otherdomain.com
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.tmp
lrwxrwxrwx    1 username username       16 Jul  2  2013 .mail_user@domain_com -> domain.com/mail_user
lrwxrwxrwx    1 username username       23 Jul 29  2013 .mail_user@otherdomain_com -> otherdomain.com/mail_user

What are all those hidden directories and can they be safely deleted? They appear to be empty folders, containing the default maildir structure (new, tmp, cur folders).
I understand that as long as the /home/user/mail/domain.com/mail_user folders exist, everything should work fine.

Other than .Sent, .Junk, .Draft, .Trash in the mail/ directory, there shouldn't be any other hidden directories under mail/ right?

Thanks in advance,
George

 

[cPanelLauren]

Hello,


The symlinks are normal:

lrwxrwxrwx    1 username username       16 Jul  2  2013 .mail_user@domain_com -> domain.com/mail_user
lrwxrwxrwx    1 username username       23 Jul 29  2013 .mail_user@otherdomain_com -> otherdomain.com/mail_user

It's not normal for these to be formatted this way:

drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.cur
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-acl-list
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot_index_cache
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot_index_log
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-uidlist
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-uidvalidity
drwxr-x--x    5 username username     4096 Nov 28 16:45 .mail_user.dovecot-uidvalidity_51f62b77

For example on my test server they're formatted as follows:

-rw-r-----  1 user user    0 Jan 16  2019 dovecot-acl-list
-rw-r-----  1 user user  400 Dec  5 12:09 dovecot.index
-rw-r-----  1 user user 8.5M Dec  4 15:20 dovecot.index.cache
-rw-r-----  1 user user 6.4M Dec  5 12:09 dovecot.index.log
-rw-r-----  1 user user 1.1M Dec  4 15:19 dovecot.index.log.2
-rw-r-----  1 user user 2.0K Nov 13 15:40 dovecot.list.index
-rw-r-----  1 user user 1.7K Dec  5 12:09 dovecot.list.index.log
-rw-r-----  1 user user   48 Mar 12  2019 dovecot.mailbox.log
-rw-r-----  1 user user   45 Dec  5 12:09 dovecot-quota
-rw-r-----  1 user user   56 Dec  5 12:09 dovecot-uidlist
-rw-r-----  1 user user    8 Apr 16  2019 dovecot-uidvalidity
-r--r--r--  1 user user    0 Jul 16  2018 dovecot-uidvalidity.5b4cf493

(no hidden files and not appended with the user)

Are you aware of changes that have been made to the mail directory here?

 

[wintech2003]

I believe it's garbage from previous/multiple migrations between servers. The setup date of this account is 2008-09-02!
What makes me wonder is why all those hidden folders have recent timestamps. I'm pretty sure they existed before that too.

So, I grep'd the cPanel access log for Nov 28 16:45 and found the following POST requests at that exact date/time:

POST /cpsessxxxxxxxxxx/execute/Personalization/get
POST /cpsessxxxxxxxxxx/execute/ResourceUsage/get_usages
POST /cpsessxxxxxxxxxx/execute/Email/list_pops_with_disk
POST /cpsessxxxxxxxxxx/execute/Resellers/list_accounts

Tthe folders are empty and I have backups anyway, so I'll go ahead and delete them.