cyrus/chk_cyrus found messages and deleted messages differs on master and slave

[Marcus Schopen]

Hi,

since a few days do I see chk_cyrus messages on one single subfolder
"sent_mail" (440 MB) of a user's mailbox in my mail.err each morning at
the same time (6:30am):

------------------
Sep 15 06:31:16 grady cyrus/chk_cyrus[25398]: user.userxyz.sent_mail uid
2 found - adding
[...]
Sep 15 06:31:50 grady cyrus/chk_cyrus[25398]: user.userxyz.sent_mail uid
1768 found - adding
------------------

The reported UIDs on the folder differ from day to day, but I always do
see about 900 log entries each morning.

Looking with an imap client into this userxyz.sent_mail subfolder all
messages except of one message seem to be deleted by the user.

System here is cyrus 2.4.12 Ubuntu 12.04 LTS with master and slave; I've
set delete_mode and expunge_mode to delayed, to be able to restored
deleted messages and folders (expire is 7 days).

The strange thing is now that on the replica/slave side the folder
userxyz.sent_mail is empty inside the filesystem in
/var/spool/cyrus/mail/u/user/userxyz/sent_mail/ (exepect this single
message) and the whole content of the send_mail folder has moved to 
/var/spool/cyrus/mail/u/DELETED/user/userxyz/sent_mail/54101FA9/.

BUT on the primary side I still do see 1774 messages in the filesystem
userxyz.sent_mail and the same number of messages in the DELETE folder
unter /var/spool/cyrus/mail/u/DELETED/user/userxyz/sent_mail/54101FA9/.
I don't understand that.

If I believe in the timestamp of the folder 
/var/spool/cyrus/mail/u/DELETED/user/userxyz/sent_mail/ on primary and
slave it was created at Sep. 10th. The chk_cyrus messages started later
at Sep. 13th.

Second strange thing:

 su - cyrus -c "/usr/sbin/unexpunge -l user.userxyz.sent_mail"

on the master doesn't show any deleted UIDs.


If I check for hardlinks I do see three UIDs hardlinked to the same
inode #10897103:

# ls -li  /var/spool/cyrus/mail/u/user/userxyz/sent_mail/1766. 
10897103 -rw------- 3 cyrus mail 5520 Sep  9
23:08 /var/spool/cyrus/mail/u/user/userxyz/sent_mail/1766.


#ls -li /var/spool/cyrus/mail/u/user/userxyz/Gesendete\ Elemente/1807. 
10897103 -rw------- 3 cyrus mail 5520 Sep  9
23:08 /var/spool/cyrus/mail/u/user/userxyz/Gesendete Elemente/1807.


# ls
-li /var/spool/cyrus/mail/u/DELETED/user/userxyz/sent_mail/54101FA9/1766.
10897103 -rw------- 3 cyrus mail 5520 Sep  9
23:08 /var/spool/cyrus/mail/u/DELETED/user/userxyz/sent_mail/54101FA9/1766.


I don't know what the user did exactly, but I think he moved/copied the
content from the "sent_mail" subfolder to another subfolder "Gesendete
Elemente", to merge different Sent folders created by different imap
clients. After that he deleted the mails inside the original
"sent_mail". No problem at all, but what's the plan to get rid of the
chk_cyrus messages? They do make me nervous. 

A "reconstruct -r user.userxyz.sent_mail" might restore deleted mails
which might confuse the user? Deleting sent_mail subfolder via an imap
client again to moved the whole sent_mail folder to DELETED and create
an empty new one? Andy ideas?

Ciao
Marcus