Technical Tip: Meaning of mail event log for IMAP subtype with'expunge: box=INBOX'

The following is a sample log entry in the 'mail event' log for IMAP subtype.

This log means that the client connecting to the FortiMail server with IMAP is deleting an email in the Inbox folder with the subject as shown in the log from their Mail User Agent (MUA).

To see this log, the 'IMAP' must be enabled in the Log Settings under Logging Policy Configuration -> Mail Event -> IMAP.

Note: This Enhancement is from v7.4.1 onwards to display the delete event logs for POP3/IMAP.

To enable (by default enabled):

config log setting local
    set imap-mail-log-event delete
    set pop3-mail-log-event delete
end

To disable:

config log setting local
    unset imap-mail-log-event clear
    unset pop3-mail-log-event clear
end