I have been running a Mailcow instance for almost two years now and have learned a lot about all things mail.

Today a folder with several subfolders and hundreds of emails vanished. I have had similar experiences before but it always turned out that the folder had just been accidentally moved into another folder. But this time, a folder is completely gone.

Now, I’m not blaming Mailcow, I’m blaming myself. I’m just wondering whether there might be any clues as to what happened exactly. Are there maybe protocols that could show me when and from which client the main folder was deleted (or renamed or whatever)? Or does Mailcow keep a journal of mail operations? Or…?

I do have hourly backups of the entire VM running Mailcow. So the mails should still be “somewhere”. My other question, therefore, is where can I find the actual mails (the “maildir”?) in my VM in Docker so I know where to look in the backup?

Thanks!

    boohoomoo

    I do have hourly backups of the entire VM running Mailcow. So the mails should still be “somewhere”. My other question, therefore, is where can I find the actual mails (the “maildir”?) in my VM in Docker so I know where to look in the backup?

    The volume your mails reside in is (on the default config) mail-vmail-vol-1. If you run a default configured docker on Debian (or Ubuntu), the volume should be in /var/lib/docker/volumes/mail-vmail-vol-1/_data.

    You can find the actions performed in a mailbox by checking the logs of mail-dovecot-mailcow-1 (inside the mailcow-folder: docker-compose logs dovecot-mailcow). You’ll see lines like that:

    Delete a message

    mail-dovecot-mailcow-1  | Nov 25 12:09:48 c4e857f4d6b7 dovecot: imap(henning@example.com)<69859><h/ZmG/gKHqasFgH4>: copy from INBOX: box=Trash, uid=2244, msgid=<EG.1183.190739.93803.9236d320@example.com>, size=367553
mail-dovecot-mailcow-1  | Nov 25 12:09:48 c4e857f4d6b7 dovecot: imap(henning@example.com)<69859><h/ZmG/gKHqasFgH4>: delete: box=INBOX, uid=13708, msgid=<EG.1183.190739.93803.9236d320@example.com>, size=367553
# ------------------------------------------------------------------| IMAP USERNAME     |---------------------------------------------------------------| MESSAGE ID                              |---------------------

    Move message to a folder

    mail-dovecot-mailcow-1  | Nov 25 12:11:57 c4e857f4d6b7 dovecot: imap(henning@example.com)<70016><kUQcI/gKxumsFgH4>: copy from INBOX: box=INBOX/Test-Folder, uid=1, msgid=<EG.1224.190740.93803.d25fb00e@example.com>, size=259925
# ------------------------------------------------------------------| IMAP USERNAME     |------------------------------------| SRC |-----| TARGET         |--------------| MESSAGE ID                              |-------------
mail-dovecot-mailcow-1  | Nov 25 12:11:57 c4e857f4d6b7 dovecot: imap(henning@example.com)<70016><kUQcI/gKxumsFgH4>: expunge: box=INBOX, uid=13707, msgid=<EG.1224.190740.93803.d25fb00e@example.com>, size=259925

    remove a folder

    mail-dovecot-mailcow-1  | Nov 25 12:12:48 c4e857f4d6b7 dovecot: imap(henning@example.com)<70067><5aopJvgK+sysFgH4>: Mailbox renamed: INBOX/Test-Folder -> Trash/Test-Folder
# ------------------------------------------------------------------| IMAP USERNAME     |-------------------------------------------| SRC             |--| TARGET          |

    To limit the output, the docker-compose logs command also allows arguments:

          --since string    Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)
      --until string    Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)

    So you can just review a timeframe the action should have happened:

    docker-compose logs --since '2023-11-01T00:00:00Z' --until '2023-11-14T23:59:59Z' dovecot-mailcow

    The limitation here is, that the logs are not stored outside docker (as far as I can see), so you loose your logs if you update mailcow and it rebuilds the dovecot container.

      Have something to say?

      Join the community by quickly registering to participate in this discussion. We'd like to see you joining our great moo-community!

      Thank you for the very detailed explanation! That is very helpful.

      No one is typing