The boss lost some email!


2013/07/10

First off, before you start checking your early retirement options, let's be sure he or she has truly lost it. Remember that "drag and drop" stuff? Sometimes people accidentally drag stuff somewhere else without having any clue that they did it, never mind where it went. As any such activity will shop up in the Kerio Connect "Operations" log, check there first. You may solve this problem instantly if you see lines like this:


[03/Jul/2013 14:43:28] {MOVE} Protocol: HTTP/WebMail,
User: [email protected], IP: 173.76.240.38, Folder:
[email protected]/INBOX, Destination Folder:
[email protected]/INBOX/save, From: "Ernesto
Frutos" <[email protected]>, Subject:
"[#RVE-792576]: Bug or expected behavior?", Msg-Id:
<[email protected]>, Delivered: 03/Jul/2013
13:06:06, Size: 2832
 


The same log will show you things that were trashed or marked as Spam:

[03/Jul/2013 14:45:00] {MOVE} Protocol: HTTP/WebMail,
User: [email protected], IP: 173.76.240.38, Folder:
[email protected]/INBOX, Destination Folder:
[email protected]/Deleted Items, From: "Newsmax.com"
<[email protected]>, Subject: "NC Senate Slips
Abortion Restrictions Into Unrelated Bill", Msg-Id:
<[email protected]>, Delivered:
03/Jul/2013 13:06:16, Size: 12844

[03/Jul/2013 14:45:06] {MOVE} Protocol: HTTP/WebMail,
User: [email protected], IP: 173.76.240.38, Folder:
[email protected]/INBOX, Destination Folder:
[email protected]/Junk E-mail, From: "Trending
Story" <[email protected]>, Subject: "Get
skin like the celebs: This is what they do", Msg-Id:
<<[email protected]>,
Delivered: 03/Jul/2013 12:26:04, Size: 3019
 


In simple cases, you might be able to just tell your boss where the missing mail is and let them drag it back to where it should be. Realize that it's possible to lose track of an entire folder this way:

[03/Jul/2013 14:52:00] {MOVE_FOLDER} Protocol:
HTTP/WebMail, User: [email protected], IP: 173.76.240.38,
Old location: [email protected]/INBOX/tempjunk, New
location: [email protected]/INBOX/save/tempjunk, Items
count: 0
 


Filters

It's also possible that a custom spam rule has been created by the Administrator. If that's you, oops. But users can create their own mail filters. You'll find those in a file called "filter.siv" in their directory (store)/mail/(domain)/(user). It's a text file so you can check it at the OS level without bothering them.

No, it's GONE!

It's still not time to panic. If you had the foresight to enable "Deleted Items Recovery", those messages may just be hiding.

Enabling deleted item recovery

You can go to User administration and restore them.

Recover deleted items

There is something potentially annoying about that. ALL deleted items will be recovered (to the Trash folder). If you just need one or two specific emails, it might be better to do this outside of Connect. It's not hard:

Using your operating system, find the boss's Connect mail folder. It's under the Store/mail/yourdomain.com/boss_logon directory. You'll see a folder called "#deleted" and inside that is a folder "#msgs" where all the stuff being held for recovery will be found. These are .eml files and you can open them with any text editor if you aren't sure from the date and time stamp which one you want.

Just grab any file and move it to the top level of his mailbox - the same place where "#deleted" and "INBOX" are. Have the boss log out and then log back in; the missing email will magically be in their INBOX.

No, REALLY GONE!

OK, but you have backups, right? You can recover a user's folder from backup. Let's say it's the "IMPORTANT" folder that has been lost. It's easy to restore from backup, but if there are still messages in "IMPORTANT " (only some messages are gone), you'll want to rename that or move it under the wing of some other folder first. Then you simply do this:

Stop Kerio Connect
Get to the command line in the directory where Kerio is installed.
Type
./kmsrecover -v -d yourdomain.com -u boss_email_login -f "IMPORTANT" /backups_folder
Start Kerio Connect.
 

See KMSRECOVER and KMSRECOVER Examples for more details.

This happened between backups!

You do have the worst luck, don't you? Well, there's one last possibility: if you have Archiving enabled, the missing email is definitely in there.

It won't be fun to find if your boss has no idea about the original date(s). The archives are strictly by date; no other organization or order at all. Finding some vaguely described message could be very difficult - better than early retirement, of course, but it can be frustrating and time consuming. There are third-party tools like MailArchiva and others that can help.

By the way, this is a good reason to do Archiving even if you don't need it for any other reason. You can delete older archives to keep the storage down; the current archive can be just what you need when you have no where else to turn.



Got something to add? Send me email.





(OLDER) <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> -> The boss lost some email!


4 comments



Increase ad revenue 50-250% with Ezoic


More Articles by

Find me on Google+

© Anthony Lawrence







Wed Jan 8 14:45:40 2014: 12399   TonyLawrence

gravatar


If you do find odd things in the logs, is the password strong?





Wed Jan 8 18:47:23 2014: 12400   TonyLaerence

gravatar


Also, rebuild the indexes for this user from the User Admin and check the Error log..



Thu Jun 5 17:37:48 2014: 12478   TonyLawrence

gravatar


Similar problem (and Operations log will show this): user has POP3 account somewhere that grabs mail and deletes it from the server; other accounts now see no mail.



Fri Jun 6 14:24:23 2014: 12479   TonyLawrence

gravatar


Recent outlook corruption issue could not see public folders:

Stop the Kerio Connect Server; navigate to the #public folder in the store; locate & delete the following files and folders:

The __keriomapi__STORE folder
The .journal.db file
The specguid.fld file

Then restart Kerio Connect Server; create a new Outlook profile for a user, and test.

Same idea may solve Outlook not seeing a folder that Webmail sees and vice versa.




------------------------
Kerio Connect Mailserver

Kerio Samepage

Kerio Control Firewall

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us





Dump may work fine for you a thousand times. But it _will_ fail under the right circumstances. And there is nothing you can do about it. (Linus Torvalds)

Thunder is good, thunder is impressive; but it is lightning that does the work. (Mark Twain)








This post tagged: