Mailbox last access - most reliable source

[Bron Gondwana]

On Tue, Jul 8, 2014, at 06:51 AM, Nic Bernstein wrote:
> On 07/07/2014 03:12 PM, Joseph Brennan wrote:
> > "Fabio S. Schmidt" <fabio at improve.inf.br> wrote:
> >
> >>  I actually need to consider only the last access via IMAP or POP 
> > protocols.
> >
> > That can be very misleading, because a device may keep checking for new 
> > mail for a very long time after the user abandons the account.
> >
> > A recent timestamp on the user.seen file should be good, but that seems to 
> > update mysteriously sometimes.
> 
> The "lastupdated:" field of cyradm's "info mailbox" command will show
> the last time the mailbox was updated in any way, so that includes
> deliveries.  The timestamp of the user.seen file will only reflect the
> last time that the seen state of anything in the mailbox changed, but
> does not tell you when the mailbox was last accessed.
> 
> I think you'd need to derive this information some other way, such as
> from authentication logs.  Of course the reliability and accessibility
> of that will depend on your authentication mechanisms.

I would go by entries in the syslog.  We run a custom saslauthd, which does
logging, so we get it from there - but this is what shows up in syslog:

imap[20174]: login: HOST [IP] user at domain plaintext User logged in

You can scan those and use them.
-- 
  Bron Gondwana
  brong at fastmail.fm