Mailbox last access - most reliable source

[Fabio S. Schmidt]

Thanks everyone for the answers !

I will scan the login entries in the syslog and use them. I thought about
redirecting all the users logins entries to a specific file and then
develop a script to delete mailboxes that have not been accessed in the
last 90 days.


-- 

My best regards,
Fabio Soares Schmidt


Linux Professional Institute - LPIC-3
Microsoft Certified Technology Specialist: Active Directory




On 8 July 2014 01:21, Bron Gondwana <brong at fastmail.fm> wrote:

> On Tue, Jul 8, 2014, at 06:51 AM, Nic Bernstein wrote:
> > On 07/07/2014 03:12 PM, Joseph Brennan wrote:
> > > "Fabio S. Schmidt" <fabio at improve.inf.br> wrote:
> > >
> > >>  I actually need to consider only the last access via IMAP or POP
> > > protocols.
> > >
> > > That can be very misleading, because a device may keep checking for new
> > > mail for a very long time after the user abandons the account.
> > >
> > > A recent timestamp on the user.seen file should be good, but that
> seems to
> > > update mysteriously sometimes.
> >
> > The "lastupdated:" field of cyradm's "info mailbox" command will show
> > the last time the mailbox was updated in any way, so that includes
> > deliveries.  The timestamp of the user.seen file will only reflect the
> > last time that the seen state of anything in the mailbox changed, but
> > does not tell you when the mailbox was last accessed.
> >
> > I think you'd need to derive this information some other way, such as
> > from authentication logs.  Of course the reliability and accessibility
> > of that will depend on your authentication mechanisms.
>
> I would go by entries in the syslog.  We run a custom saslauthd, which does
> logging, so we get it from there - but this is what shows up in syslog:
>
> imap[20174]: login: HOST [IP] user at domain plaintext User logged in
>
> You can scan those and use them.
> --
>   Bron Gondwana
>   brong at fastmail.fm
> ----
> Cyrus Home Page: http://www.cyrusimap.org/
> List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
> To Unsubscribe:
> https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.andrew.cmu.edu/pipermail/info-cyrus/attachments/20140708/8f3f3664/attachment-0001.html