FortiMail
FortiMail provides advanced, multi-layer protection against the full spectrum of email-borne threats
srahmat
Staff
Staff
Article Id 404770
Description This article describes the meaning of the log 'expunge: box=INBOX' in the mail event log for IMAP subtype.
Scope FortiMail server mode.
Solution

The following is a sample log entry in the 'mail event' log for IMAP subtype.

 

image.png

 

This log means that the client connecting to the FortiMail server with IMAP is deleting an email in the Inbox folder with the subject as shown in the log from their Mail User Agent (MUA).

 

To see this log, the 'IMAP' must be enabled in the Log Settings under Logging Policy Configuration -> Mail Event -> IMAP.

 

image.png

 

Note: This Enhancement is from v7.4.1 onwards to display the delete event logs for POP3/IMAP.

 

To enable (by default enabled):


config log setting local
    set imap-mail-log-event delete
    set pop3-mail-log-event delete
end

 

To disable:


config log setting local
    unset imap-mail-log-event clear
    unset pop3-mail-log-event clear
end