How can we save all email traffic and other things from clients (e-evidence law)

Richard G

Verified User
Joined
Jul 6, 2008
Messages
14,584
Location
Maastricht
In the EU we have a new law called E-Evidence Regulation and Directive.
The Regulation lays down the rules under which an authority of a Member State, in criminal proceedings, may issue a European Production Order or a European Preservation Order and thereby (directly) order a service provider offering services in the Union and established in another Member State, or, if not established, represented by a legal representative in another Member State, to produce or to preserve electronic evidence regardless of the location of the data.

This is also appyable to all hosters and registrars too including ZZP business (as we call them in Dutch).

In short, when requested, we are required (mostly within 24 hours but in certain cases within 8 hours) to keep logs of all activity including e-mail traffic (incoming and outgoing) and content if I understood correctly, of an account/domain, when legally requested from a country within the EU.
This concerns digital data such as emails, text messages and traffic data, which are used to investigate and prosecute criminal offences.

They start in march 2026 implementing and it will be in effect for everybody august 1st 2026.

Maybe some Dutch collegues @Active8 @Driesp or others, already had the letter from the Ministery as I did the day before yesterday and have a clue on how something like this can more ore less easily be build in or activated or have ideas on how to implement something like that so these kind of things can all be started/saved once asked for by legal action.
 
For the webserver logging, "logs_history_as_nobody" and "logs_to_keep_days" can combined to ensure to keep the logs and prevent deleted from the user.

and keep the backup even user has been removed for 180 days.

============
So the evildent can remove by user if missing "nobody" permission.
 
For Apache log, if possible, it'd better to change the naming convention
from
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz.1
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz.2
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz.3
to
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz-20251118
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz-20251119
/home/xxxxxx/domains/yyyy.com/logs/Nov-2025.tar.gz-20251120

It is much efficient for incremental backup (to save multiple copies, e.g. 30, 60, 180 days copies)


For the webserver logging, "logs_history_as_nobody" and "logs_to_keep_days" can combined to ensure to keep the logs and prevent deleted from the user.

and keep the backup even user has been removed for 180 days.

============
So the evildent can remove by user if missing "nobody" permission.
 
"logs_to_keep_days", this option will ensure if you manual tally the logs, it's still keep the logs and not replace on the same day.

so you can start tally, export user via admin backup, export email logs in "/var/log/exim/" , "/var/log/mail*".
 
Back
Top