6.0.0-beta1
11/6/25

[#5215] Logging for deleted messages
Summary Logging for deleted messages
Queue IMP
Queue Version 4.1.2
Type Enhancement
State Rejected
Priority 1. Low
Owners
Requester webadmin (at) ualberta (dot) ca
Created 04/04/2007 (6791 days ago)
Due
Updated 04/12/2007 (6783 days ago)
Assigned
Resolved 04/12/2007 (6783 days ago)
Milestone
Patch No

History
04/12/2007 03:34:07 PM webadmin (at) ualberta (dot) ca Comment #7 Reply to this comment
I pretty much agree, though I can see an argument for more
flexibility on the Horde/IMP side. Basically if we can provide a hook
to do this painlessly I'm for it, but otherwise I'd use something
like the IMAP telemetry logs (available from at least cyrus imapd) to
accomplish it.
That'd work if the sysadmin running Horde/Imp is the same admin in 
control of the IMAP server.  I'm not sure how many installations are 
like that but ours is not.  We have a team that just deals with our 
IMAP cluster and have nothing at all to do with our horde 
installation.  Not to mention that with 20 different departmental 
servers accessing their imap servers via horde it becomes impossible 
for me to troubleshoot problems with those users since I have no 
access whatsoever to their IMAP logs.
04/12/2007 02:45:18 PM Chuck Hagenbuch Comment #6
State ⇒ Rejected
Reply to this comment
I pretty much agree, though I can see an argument for more flexibility 
on the Horde/IMP side. Basically if we can provide a hook to do this 
painlessly I'm for it, but otherwise I'd use something like the IMAP 
telemetry logs (available from at least cyrus imapd) to accomplish it.
04/12/2007 02:32:56 PM Michael Slusarz Comment #5 Reply to this comment
I agree with Jan.  Logging, if any, should take place on the IMAP/POP 
server, not via IMP.
04/11/2007 02:13:49 PM webadmin (at) ualberta (dot) ca Comment #4 Reply to this comment
I don't think this makes sense for a broader audience. Any other opinions?
Really?  You'd think that detailed administrative logs would be quite 
valuable - especially for larger installations.  In an educational 
environment such as ours I have had to deal with this over and over 
again - the students can get quite creative when they haven't done 
their homework or project.  The onus always comes back to us to show 
that no, Imp did NOT do something it shouldn't have... YOU did, but 
without reasonably detailed logs we couldn't prove anything.



This has already been useful... yesterday morning I was glancing 
through the logs to see what information I was getting from the new 
additions and right off the bat I saw a user that had deleted his 
trash folder and his sent mail folder.  Sure enough about an hour 
later the help desk got a call from that user complaining about how 
horrible the system was because it was deleting things by itself.



It's also interesting to see how users are actually using the empty 
trash function.  You can tell that certain users have set their inbox 
page length to, say, 20 messages when it shows that they empty their 
trash of exactly 20 messages over and over and over again.



I've been thinking a bit more about it and thought that it could 
possibly be improved by adding config options in one of the conf files 
to allow admins to set exactly what they want logged in terms of 
administrivia.  We have more than enough logs between horde logs and 
apache logs to diagnose system problems... but there is currently very 
little that can be logged when it comes to dealing with users.  Just 
my opinion though...
04/11/2007 01:53:10 PM Jan Schneider Comment #3
State ⇒ Feedback
Reply to this comment
I don't think this makes sense for a broader audience. Any other opinions?
04/05/2007 08:50:24 PM webadmin (at) ualberta (dot) ca Comment #2 Reply to this comment
Related to this addition I've hacked in one more for the same reason.   
This one will log the folders that a user deletes.  Anything that 
perminantly removes user data should be logged because invariably the 
users will either do somethign stupid to themselves and will pretend 
it's Imp's fault to avoid the recovery fees OR it WILL be Imp's fault 
and we'll need a way to show it.



Anyway... the following is a diff of /horde/imp/lib/Folder.php



--- Folder.php.orig     Thu Apr  5 13:36:01 2007

+++ Folder.php  Thu Apr  5 14:38:00 2007

@@ -207,8 +207,10 @@

       */

      function delete($folder_array, $subscribe)

      {

-        global $conf, $notification;

+       /* KK added $imp to globals to support additional code below */



+        global $imp, $conf, $notification;

+

          $server = IMP::serverString();

          $return_value = true;

          $deleted = array();

@@ -252,6 +254,22 @@



              /* Recreate Virtual Folders. */

              $GLOBALS['imp_search']->sessionSetup();

+

+           /*  Added by KK - April 5/07

+            *

+            *  Determine list of folders (1..N) a user has deleted and log it

+             *

+            */

+

+           $del_names = array();

+           foreach ($deleted as $KK_del) {

+               array_push($del_names,IMP::displayFolder($KK_del));

+           }

+           $outval = join(', ',$del_names);

+            $entry = sprintf("%s User %s deleted folder(s):  %s", 
$_SERVER['REMOTE_ADDR'],$imp['user'],$outval);

+            Horde::logMessage($entry, __FILE__, __LINE__, PEAR_LOG_INFO);

+

+           /*  End KK */

          }



          return $return_value;


04/04/2007 06:52:49 PM webadmin (at) ualberta (dot) ca Comment #1
Priority ⇒ 1. Low
Type ⇒ Enhancement
Summary ⇒ Logging for deleted messages
Queue ⇒ IMP
State ⇒ New
Reply to this comment
The one thing that keeps biting us on the ass is when users claim that 
Imp "ate my mail".  As it stands there's no way for us to prove that 
the user himself didn't delete his messages so it makes it a bit 
sticky when going to charge them for data recovery.  So I hacked in 
the following code to add log messages when a user empties the trash 
folder.  The reason I'm submitting it as an enhancement is because a) 
I think it's very useful from an administration standpoint to be able 
to determine when a user empties his trash folder so other admins 
should have this ability and b) I want to keep my codebase as "stock" 
as I can to make future upgrades possible.



Please note... there is very likely a better way to do this 
(especially since my php skills are rudimentary) but it achieved the 
desired result.  The hacked file is /horde/imp/lib/Message.php.  If 
this addition will cause problems that I'm not seeing please let me 
know so I can remove it from my local installation.





--- Message.php.orig    Wed Apr  4 12:06:43 2007

+++ Message.php Wed Apr  4 12:39:20 2007

@@ -237,6 +237,14 @@

                      $overview = @imap_fetch_overview($imp['stream'], 
$sequence, FT_UID);

                  }



+               /*

+                *  Added by KK Apr4/07

+                *

+                *  Get the list of Message-IDs for the deleted messages

+                */

+

+               $delArray = @imap_fetch_overview($imp['stream'], 
$sequence, FT_UID);

+

                  /* Delete the messages. */

                  if (!@imap_delete($imp['stream'], $sequence, FT_UID)) {

                      if ($this->_usepop) {

@@ -277,6 +285,27 @@

                          require_once IMP_BASE . '/lib/Maillog.php';

                          IMP_Maillog::deleteLog($msg_ids);

                      }

+

+

+

+                /*

+                 *  Added by KK Apr4/07

+                 *

+                 *  Count the number of messages that have been 
deleted and log the info.

+                 */

+

+               $msg_ids = array();

+                foreach ($delArray as $val) {

+                       if (!empty($val->message_id)) {

+                               $msg_ids[] = $val->message_id;

+                        }

+                }

+               $kk = count($msg_ids);

+               $entry = sprintf("%s Messages in Trash folder [%d] 
deleted by user %s", $_SERVER['REMOTE_ADDR'], $kk,$imp['user']);

+               Horde::logMessage($entry, __FILE__, __LINE__, PEAR_LOG_INFO);

+

+

+

                  }

              }

          }


Saved Queries