On 16/5/2025 10:28 μ.μ., Arkadiusz Miśkiewicz via dovecot wrote:
deliver_log_format = msgid=%m, storage_id=%{storage_id}
so you will know file name for stored email and then
inotifywatch to recursively monitor maildir. You will know what
deletes that file and you could focus on debugging that.
Thank you for the hint.
Could you suggest a specific setup to run inotifywatch or inotifywait as
a service and monitor the whole of /home/vmail for file deletions in a
way that both the deleted filename and the deleting process are logged?
It seems that inotifywait cannot identify the deleting process because
it operates at the filesystem level and doesn’t have insight into
process/user metadata.
I have seen suggestions to use inotifywait and auditd combined, but
setups are not that straightforward. Moreover, I think that the number
of file events/deletions is probably large so we might end up in huge
log files.
Please advise!
Thanks,
Nick
_______________________________________________
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org
