Hi folks!
I have a strange situation:
My mailcow installation is dockerized and its containers get updated from time to time by watchtower.
I am making backups of all volumes on a daily basis.
3 days ago, in - as far as i can see - just ONE mailbox the number of mails in its main /cur dropped from 8000+ to around 700 back from in the year 2013 beeing the newest mail. Subfolders are not affected.
I have no clue how those mails vanished - deleting that via the webinterface would be a lot of work :-)
So I copied those 8000 files back to the folder where they were before.
- shutdown the system with docker-compose down
- copy the mailfiles back to /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/domain/user/Maildir/cur/
- chown -R 5000:5000 everything in that cur folder
- docker-compose up -d
Then, ls | wc -l shows around 8000 files… but then suddenly starts to drop again!
The log of the dovecot container shows:
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52529, msgid=, size=5330
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52530, msgid=, size=41249
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52531, msgid=, size=88115
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52532, msgid=, size=88580
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52533, msgid=, size=18284
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52534, msgid=, size=144868
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52535, msgid=, size=12889
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52536, msgid=, size=13792
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52537, msgid=, size=2968
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52538, msgid=, size=10040
Apr 13 20:51:40 66c8393ab71f dovecot: imap(xxx@xxx.com)<222><xckuHt+/o3usFgH4>: expunge: box=INBOX, uid=52539, msgid=, size=11757
So I am asking: what process is expunging those mails - and where is it configured / triggered?
any hint is highly appreciated!