Highlighted
JoeAtWork Contributor.
Contributor.
40 views

Deleted mail logged but cannot correlate

Hi All,

On my GroupWise 18.0.1 server I have the setting enabled "Collect Other Status Reports" on my domain MTA so I can see when the users delete mail.  Does this hold true for mail that is ONLY sent between 2 GroupWise users or will it also record when a message comes in from the internet and the user deletes it?

When I look at my logs I see several logged items related to the "purge" of mail:

am/0905poa.02b:23:28:55 D0CB Purge item record #26696
am/0905poa.02b:23:28:55 D0CB Purge message record #117304
am/0905poa.02b:23:36:51 D22D Purge settings (bag) record #263986 (LDAPuser)
am/0905poa.02b:23:39:37 D039 Purge Execution Record #79876 App( SOAP )

 

I am not seeing anything that makes sense, when a human looks I would be looking for one of these three items:

Message Id
Record Id
Common Record Id

so I have two reasons why I would want to look for deleted mail:

1) user a reports that they sent a message on Friday and it is not in the GroupWise sent items, it is not in retain, it is not in the legacy archive and they swear they did not delete it.  I go to a person who the message was CCed to and look at user a's mailbox for the message and sure enough it is not anywhere.  But I do have a Message, record and common record to look for.

2) user a has shared his password with user B, user B is on a web mail session and deletes a message.  I want to work backwards and find if that purge record was an email that was also sent to other users.  I know the purge was done from a different IP address and it was not a client server connection.

 

Thanks,

Joe

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.