-1

I'm beginning to be desperate regarding a mail that seems to have completely disappeared on my Ubuntu Linux 10.04 LTS 64 bit server running qmail+vpopmail. Every domain has a .qmail-default containing the following: /home/vpopmail/bin/vdelivermail '' bounce-no-mailbox

Furthermore the server has software RAID1 with 3 hard-drives.

Here is what happened:

May 8 at 8:59 user A sends a message to user B and C. A, B and C are all local mail users. a-local-domain, b-local-domain and c-local-domain are all hosted at my server (hence the names).

2013-05-08 08:59:18.240881500 new msg 264573
2013-05-08 08:59:18.240882500 info msg 264573: bytes 1641963 from <a@a-local-domain.com> qp 9051 uid 33
2013-05-08 08:59:18.240899500 starting delivery 1570: msg 264573 to local b-local-domain.com-b@b-local-domain.com
2013-05-08 08:59:18.240900500 status: local 1/10 remote 0/10
2013-05-08 08:59:18.240901500 starting delivery 1571: msg 264573 to local c-local-domain.com-c@c-local-domain.com
2013-05-08 08:59:18.240907500 status: local 2/10 remote 0/10
2013-05-08 08:59:18.475726500 delivery 1571: success: did_0+0+1/
2013-05-08 08:59:18.475750500 status: local 1/10 remote 0/10
2013-05-08 08:59:19.210562500 delivery 1570: success: did_0+0+1/
2013-05-08 08:59:19.210631500 status: local 0/10 remote 0/10
2013-05-08 08:59:19.210669500 end msg 264573

User C has confirmed that he received the message successfully. User B, however, claims never to have received the message. And I believe he is right:

At May 8 08:30:05 user C logs in and checks his mail. He does not check mail until May 9 12:01:27. I see this in the mail.info log files.

I have a daily back-up from May 9 04:30, and here the mail is not present! It should be here, because user C could not have deleted the message. The mail is totally local, no chance of spam-filter interference.

And no: user C has not set up any mail forwarding - I've checked it myself.

Where should I start digging? My server hardware, RAID, file system, qmail, vpopmail???

Any help much appreciated!

Vering
  • 111
  • 5

1 Answers1

1

The log line says:

2013-05-08 08:59:18.475726500 delivery 1571: success: did_0+0+1/

The figures at the end of the line are 0+0+1

The first figure means local delivery. The second is forwarding. The third is delivery to a program.

So, in this case, the delivery was 0 local delivery, 0 forwarding, and 1 passing to a program.

I'd be willing to bet quite a lot that there's a .qmail which is handing these mails over to a program, probably procmail.

Jenny D
  • 27,780
  • 21
  • 75
  • 114
  • Thank you very much for your reply. However, I'm not using procmail, and all other log entries that I've checked looks the same: did_0+0+1/. – Vering May 12 '13 at 20:04
  • So what does the .qmail or .qmail-exetension look like? – Jenny D May 13 '13 at 03:56
  • Every domain has a .qmail-default containing the following: /home/vpopmail/bin/vdelivermail '' bounce-no-mailbox – Vering May 13 '13 at 10:15
  • This would have been very useful information in the original question... You need to check the vpopmail logs instead of the qmail logs. If vpopmail wasn't built with logging enabled, rebuild it with '--enable-logging=y` to log all attempted deliveries. – Jenny D May 13 '13 at 10:28
  • I've updated the original post, thanks. But yes, it seems that I should look closer at vpopmail. I have build vpopmail with logging, but it might fail without debug info? I'll check the logs again as soon as possible. – Vering May 13 '13 at 11:15
  • Another thing to check - you do know that mails will move from the Maildir/new to the Maildir/cur folder when they check their mail, and may get their name altered too? So just searching for the filename may not locate the mail. That one has bitten me more than once... – Jenny D May 13 '13 at 11:17
  • Yes that's right. But I also did check the cur folder and the strange thing is, that user C did not check his mail during the timeslot between receiving the mail and the dialy backup. Also in this timeslot he received another mail which is correctly placed in the new folder. Thanks. – Vering May 13 '13 at 11:28
  • I've looked through the vpopmail logs again (it logs into syslog), but I cannot find anything indicating errors. I'll recompile vpopmail with --enable-file-sync --enable-mysql-replication (in order to better support back-up) Then I'll try this: 1. inject the failed message again before updating with the new vpopmail 2. injecting the failed message afterwards – Vering May 14 '13 at 06:29