Deleted mail logged but cannot correlate
On my GroupWise 18.0.1 server I have the setting enabled "Collect Other Status Reports" on my domain MTA so I can see when the users delete mail. Does this hold true for mail that is ONLY sent between 2 GroupWise users or will it also record when a message comes in from the internet and the user deletes it?
When I look at my logs I see several logged items related to the "purge" of mail:
am/0905poa.02b:23:28:55 D0CB Purge item record #26696
am/0905poa.02b:23:28:55 D0CB Purge message record #117304
am/0905poa.02b:23:36:51 D22D Purge settings (bag) record #263986 (LDAPuser)
am/0905poa.02b:23:39:37 D039 Purge Execution Record #79876 App( SOAP )
I am not seeing anything that makes sense, when a human looks I would be looking for one of these three items:
Common Record Id
so I have two reasons why I would want to look for deleted mail:
1) user a reports that they sent a message on Friday and it is not in the GroupWise sent items, it is not in retain, it is not in the legacy archive and they swear they did not delete it. I go to a person who the message was CCed to and look at user a's mailbox for the message and sure enough it is not anywhere. But I do have a Message, record and common record to look for.
2) user a has shared his password with user B, user B is on a web mail session and deletes a message. I want to work backwards and find if that purge record was an email that was also sent to other users. I know the purge was done from a different IP address and it was not a client server connection.