Mail disappearing

T

twv

Verified User
Joined
Oct 31, 2003
Messages
216
One of my users is having an odd problem. He deleted and recreated his email address in the control panel, and now some emails to him disappear without being delivered. He gave me his password to test, and when I log into roundcube as him and send an email to his account it isn't delivered.

Exim log:
Code: 
2012-11-07 20:22:21 1TWGp3-0002LZ-5M <= [email protected] H=localhost.localdomain (www.domain.tld) [127.0.0.1] P=esmtpa A=login:[email protected] S=592 [email protected] T="Test" from <[email protected]> for [email protected]
2012-11-07 20:22:22 1TWGp3-0002Lg-Ch <= [email protected] U=mail P=spam-scanned S=983 [email protected] T="Test" from <[email protected]> for [email protected]
2012-11-07 20:22:22 1TWGp3-0002Lg-Ch => user <[email protected]> F=<[email protected]> R=virtual_user T=virtual_localdelivery S=1090
2012-11-07 20:22:22 1TWGp3-0002Lg-Ch Completed
2012-11-07 20:22:22 1TWGp3-0002LZ-5M => user <[email protected]> F=<[email protected]> R=spamcheck_director T=spamcheck S=855
2012-11-07 20:22:22 1TWGp3-0002LZ-5M Completed

Dovecot log:
Code: 
Nov  7 20:22:21 server1 dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=9029, secured, session=<GOGvqvHN6gB/AAAB>
Nov  7 20:22:21 server1 spamd[2102]: spamd: connection from localhost.localdomain [127.0.0.1] at port 55218 
Nov  7 20:22:21 server1 spamd[2102]: spamd: setuid to client succeeded
Nov  7 20:22:21 server1 dovecot: imap([email protected]): Disconnected: Logged out in=447 out=546
Nov  7 20:22:21 server1 spamd[2102]: spamd: processing message <[email protected]> for client:526
Nov  7 20:22:22 server1 spamd[2102]: spamd: clean message (-2.7/7.5) for client:526 in 1.1 seconds, 592 bytes.  
Nov  7 20:22:22 server1 spamd[2102]: spamd: result: . -2 - ALL_TRUSTED,AWL,BAYES_00 scantime=1.1,size=592,user=client,uid=526,required_score=7.5,rhost=localhost.localdomain,raddr=127.0.0.1,rport=55218,mid=<[email protected]>,bayes=0.000000,autolearn=ham

Oddly, some emails (from external addresses) are delivered, but not all.

There is nothing relevant in /var/log/exim/rejectlog
 
Hello,

You'd better use exigrep:

Code: 
exigrep 1TWGp3-0002LZ-5M /var/log/exim/mainlog

and

Code: 
exigrep 1TWGp3-0002Lg-Ch /var/log/exim/mainlog

to gather all lines related to one email with specified searching string.
 
exigrep 1TWGp3-0002LZ-5M /var/log/exim/mainlog
Code: 
2012-11-07 20:22:21 1TWGp3-0002LZ-5M <= [email protected] H=localhost.localdomain (www.domain.tld) [127.0.0.1] P=esmtpa A=login:[email protected] S=592 [email protected] T="Test" from <[email protected]> for [email protected]
2012-11-07 20:22:22 1TWGp3-0002LZ-5M => user <[email protected]> F=<[email protected]> R=spamcheck_director T=spamcheck S=855
2012-11-07 20:22:22 1TWGp3-0002LZ-5M Completed

exigrep 1TWGp3-0002Lg-Ch /var/log/exim/mainlog
Code: 
2012-11-07 20:22:22 1TWGp3-0002Lg-Ch <= [email protected] U=mail P=spam-scanned S=983 [email protected] T="Test" from <[email protected]> for [email protected]
2012-11-07 20:22:22 1TWGp3-0002Lg-Ch => user <[email protected]> F=<[email protected]> R=virtual_user T=virtual_localdelivery S=1090
2012-11-07 20:22:22 1TWGp3-0002Lg-Ch Completed

An odd thing is that after sending the mail it sometimes appears briefly in the roundcube inbox. But when I click to read it roundcube gives an error "Message not found." Not sure if that's because roundcube knows it should be there because it sent it or because some other process is deleting it.

I suspected that the user had some other computer checking email via POP3 and deleting it, but he assures me that that's not the case and I can see no POP3 logins in /var/log/maillog for this address.

More oddness: today when I send from roundcube the messages do come into the inbox and stay there.
 
twv said:
An odd thing is that after sending the mail it sometimes appears briefly in the roundcube inbox. But when I click to read it roundcube gives an error "Message not found." Not sure if that's because roundcube knows it should be there because it sent it or because some other process is deleting it.
Click to expand...
When an email is delivered into an imap mailbox, some index records are created. Dovecot depends on these records to find the email, but if it's not there, Dovecot may be fixing the index once it tries to find the email and realizes it's not there.

You could have a problem with one or more emails in your inbox having a header causing problems, or a problem with your indexes.

First delete all the index files; they all start with dovecot in the file name. Just delete them; the next time Dovecot is logged into the account it will recreate them based on the actual contents of the mailbox.

If this doesn't solve your problem you'll need to move further. The following is complex and could lose you all your email if you're not careful. Note I'm NOT RESPONSIBLE if you make a mistake and lose all your email. If you want, I can do this as a service, and I won't lose your email; if you follow my instructions and you do, then even if I've made a mistake in these instructions I'm NOT RESPONSIBLE if you lose all your email. You've been warned.

From a root shell login, check the mailbox contents (both the new and the curdirectory), look for the specific email you can't find while using RoundCube. A simple way to do this, is to send an email to the account with a very specific subject line, for example abcde55431 or similar, then you can grep for it this way to see if the file is actually in the directory:
Code: 
# cd /home/USERNAME/imap/DOMAIN.NAME/MAILBOXNAME/Maildir/
grep "Subject:" */*
If the email is there but can't be found by an email client even with newly created indexes, you've got to clear out all the emails with bad headers which may be confusing Dovecot.

The easy way to do this is to log in using Roundcube, create two new mailboxes as sub-mailboxes of the inbox, for example: savecur and savenew. Then log out of Roundcube.

Then from the root shell move all the contents of /home/USERNAME/imap/DOMAIN.NAME/MAILBOXNAME/Maildir/cur to /home/USERNAME/imap/DOMAIN.NAME/MAILBOXNAME/Maildir/.INBOX.savecur/cur and the contents of /home/USERNAME/imap/DOMAIN.NAME/MAILBOXNAME/Maildir/new to /home/USERNAME/imap/DOMAIN.NAME/MAILBOXNAME/Maildir/savenew/cur creating the new directory paths if necessary (if you need to do this you need to make sure your permissions and ownerships are correct; look at other submailboxes to see how to do this.

Once done with the moves, delete the indexes again.

Then you should be able to move in through Roundcube and manually move back the emails from INBOX.savecur and INBOX.savenew to the INBOX directory, skipping of course all the spam and junk mail. Finally delete from those two mailboxes all the junk you don't want and haven't moved.

This is tedious and you must be careful to not make mistakes. Hire me or someone else to do it if you need to. I guarantee my work but do not accept responsibility for anyone following instructions in my posts. I backup everything before making changes so I won't lose email.

To contact me to work for you, send an email to the address below in my siglines; do NOT use a PM.
I suspected that the user had some other computer checking email via POP3 and deleting it, but he assures me that that's not the case and I can see no POP3 logins in /var/log/maillog for this address.
Click to expand...
That doesn't mean it's not happening. You might want to block his connections temporarily using your firewall and see if emails get through then.

Jeff
 
Thank you very much for the help. Deleting the indexes did not fix it, so I moved the mail like you suggested. I also deleted all the mail in the Trash and Deleted Messages folders and then removed the indexes again.

So far, it seems to have fixed the problem.
 
Update: everything was working fine in roundcube but when he checked mail in Mac Mail some of it disappeared again. Presumably there is something wrong in his mail program?
 
It could have more to do with the Mac Mail.app. I have had problems in the past with some emails not appearing. It had to do with corrupted indexes. Of course I was using IMAP and not POP3, so I could just remove the indexes for Mail.app and they were rebuilt the next time I started the app.
 
He is using IMAP, too. I will give him a heads up about removing indexes for Mail.app. Thanks.
 
You must log in or register to reply here.
Back
Top