dovecot - Jul 2012 - Couple of questions about the logs

The log entries for imap disconnection shows a "bytes = x/y" format 
where the x equals bytes sent from client and y equals bytes received 
from client.

Can someone explain that a little better to me, please? In an imap 
account, does this "y" represent the size of the header information 
being returned to the client or the amount of data of the email mailbox?

Also, is there a way to tell if an email has been deleted (or marked for 
deletion) when using an imap client?

Here's the situation:

I've got a user who uses imap when using his phone and webmail. When in 
the office, he uses a pop3 client on his desktop. He indicates he's 
missing some emails from the weekend when first turning on his desktop. 
I know of no way to discover if he's deleted and then purged email from 
his mailbox using imap clients. I've checked the logs and he does not 
access his mailbox simultaneously from any of the 3 clients.

I can find 31 emails he received since his last pop login on Friday 
until his first pop login on Monday. The pop login indicates he received 
only 27 emails during the pop retrieval.

I'm a little lost here. Any help would be appreciated in interpreting 
the logs or suggesting how this might have happened.

thanks

steve campbell

On 23.07.2012 17:31, wrote Steve Campbell:
> The log entries for imap disconnection shows a "bytes = x/y"
format
> where the x equals bytes sent from client and y equals bytes received
> from client.
>
> Can someone explain that a little better to me, please? In an imap
> account, does this "y" represent the size of the header
information
> being returned to the client or the amount of data of the email mailbox?
>
> Also, is there a way to tell if an email has been deleted (or marked for
> deletion) when using an imap client?
>
> Here's the situation:
>
> I've got a user who uses imap when using his phone and webmail. When in
> the office, he uses a pop3 client on his desktop. He indicates he's
> missing some emails from the weekend when first turning on his desktop.
> I know of no way to discover if he's deleted and then purged email from
> his mailbox using imap clients. I've checked the logs and he does not
> access his mailbox simultaneously from any of the 3 clients.
>
> I can find 31 emails he received since his last pop login on Friday
> until his first pop login on Monday. The pop login indicates he received
> only 27 emails during the pop retrieval.
>
> I'm a little lost here. Any help would be appreciated in interpreting
> the logs or suggesting how this might have happened.
>
> thanks
>
> steve campbell
This probably doesn't help with the current case but for the future you 
could enable mail_log plugin to log several user events:

http://wiki2.dovecot.org/Plugins/MailLog