worried: unwanted mailpurge ?!

[glenndm]

Hello,
today I discovered all of the old messages (10 years worth) in one account were missing / deleted.
looking at the backups, the deletion happened sometime last week.

I'm reasonably sure that there are no retention/disposal rules set - meaning every message in the account should stay until explicitly deleted
as the messages were in several (now empty) subfolders, also pretty sure the deletion was not a user mess-up.

Now I'm restoring the last good backup to a temporary account and will move the messages back to the primary one.
mainly because I don't know if directly restoring to the actual account is a good idea (duplicates ?)

during this operation, I checked the mailbox.log for a progress status of the restore.
I came across this !!??:

Code: Select all

2024-11-27 16:13:14,278 INFO  [MailboxPurge] [name=info@xxxxx.com;mid=8;] purge - Purging messages.
2024-11-27 16:13:14,279 INFO  [MailboxPurge] [name=info@xxxxx.com;mid=8;] mailop - Deleting MESSAGES: 87074.
2024-11-27 16:13:14,279 INFO  [MailboxPurge] [name=info@xxxxx.com;mid=8;] mailop - Deleting VIRTUAL_CONVERSATIONS: 87074.
2024-11-27 16:14:14,327 INFO  [MailboxPurge] [name=spam_zimbra@xxxxx.com;mid=9;] purge - Purging messages.

Does this mean the info account is now being purged? (info was not the account affected)
or is this a byproduct of the restore - the lines referring to the contents of the backup?

Any reassurance is greatly appreciated

[ghen]

Yes, "MailboxPurge" is a Zimbra thread that is periodically purging messages from mailboxes according to the following settings:

• zimbraMailMessageLifetime
• zimbraMailSpamLifetime (default 30d)
• zimbraMailTrashLifetime (default 30d)
• zimbraPrefInboxReadLifetime
• zimbraPrefInboxUnreadLifetime
• zimbraPrefJunkLifetime
• zimbraPrefSentLifetime
• zimbraPrefTrashLifetime

which can be set on COS level and/or on individual account level.
(the first 3 are admin configurable, the others user configurable)

do `zmprov ga account@domain | grep Lifetime` to see if any of these are set for those users or their COS. (0 means no purging.)

[liverpoolfcfan]

I would check for any signs of compromise on the server in case it is a deliberate act

[liverpoolfcfan]

By the way, in this case

2024-11-27 16:13:14,279 INFO [MailboxPurge] [name=info@xxxxx.com;mid=8;] mailop - Deleting MESSAGES: 87074.

just means that message Id 87074 was purged. It does not mean that 87,074 messages were purged

[glenndm]

By the way, in this case

2024-11-27 16:13:14,279 INFO [MailboxPurge] [name=info@xxxxx.com;mid=8;] mailop - Deleting MESSAGES: 87074.

just means that message Id 87074 was purged. It does not mean that 87,074 messages were purged

Thanks for your reply,
you're right about ID, I was closely monitoring the info account, fearing to see messages disappear wholesale.
As that did not happen, the message ID 87074 to be junk and deleted makes more sense

Compromised server is (in this case) not likely. If not a server glitch, some (elaborate?)user error is probable.

At the moment, I'm struggling with the restore.
While I can restore the old messages, all newer messages since the backup get deleted no matter what option I choose on admin console.
maybe I need to delve into commandline to get the desired result = restore messages as per chosen backup time while keeping current messages in account

stressful times

[glenndm]

At the moment, I'm struggling with the restore.

The restore finally was not a thing of beauty:
1. I exported the active account for the last 2 weeks (webclient/pref/import.export)
2. restore that account from the last backup with the full history ( 2 weeks old)
this restore first delete/empties the account beforing restoring
3. re-import the messages of the last 2 weeks (step1)

This seem to be as near as I (now) can get to the desired solution.
The rest is for Future me (wink to superfastmatt for those who know)

[Klug]

Which version of ZCS are you using?
Is that a 10.x version (and the new backup system)?

Your profile says it's 8.8.15. But not NE.
So how do you backup?

[glenndm]

the current is 8.8.15 NE
forum profile entry truncates zmcontrol -v output : Release 8.8.15.GA.3829.UBUNTU16.64 UBUNTU16_64 NETWORK edition, Patch 8.8.15_P45.

backup is the NE builtin one.
10.1 is planned round end of year

best regards