25.6  Operations

The Operations log gathers information about removed and moved items (messages, contacts, events, tasks and notes) in user mailboxes. It is helpful especially if a user does not manage to find a particular message in their mailbox. The log tells us whether the desired message has not been removed.

In addition to the items related information, the log also includes information about removing and moving any folders in mailboxes.

Besides removals, the log also gathers information about moving folders (it treats them as subfolders removed from the particular folder). Moving of folders is marked by a special flag.

The information is recorded following this pattern:

Removed (moved) item

[07/Aug/2008 11:07:02] {DELETE} Protocol: HTTP/WebMail, User: wsmith@company.com, IP: 127.0.0.1, Folder: ~wsmith@company.com/Deleted Items, From: "Winston Smith" <wsmith@company.com>, Subject: "Vacations", Delivered: 07/Aug/2008 11:05:27, Size: 1320

  • [07/Aug/2008 11:07:02] — date and time of the operation (moving or removing of an item).

  • {DELETE} — operation type. The item was removed or moved.

  • Protocol — type of protocol used for removal or moving of the item. The protocol type tells us by which email client the user accessed the server (examples: HTTP/WebMail — the Kerio WebMail interface, SYSTEM — automatic deletion of items, HTTP/WebDAV — MS Outlook extended with Kerio Outlook Connector or MS Entourage).

  • User — user mailbox where the operation took place.

  • IP — IP address of the computer which the operation was executed from.

  • Folder — the folder where the operation took place.

  • Subject — subject of the item.

  • Delivered — date of delivery of the item in case of emails.

  • Size — size of the item.

Folder removal

[07/Aug/2008 12:14:57] {DELETE_FOLDER} Folder: ~jpalmer@company.com/Deleted Items/Work deleted

  • [07/Aug/2008 12:14:57] — date and time of the operation (removal of the folder).

  • {DELETE_FOLDER} — operation type. The folder was removed.

  • Folder — name of the deleted folder.

  • deleted — operation.

Folder movement

[07/Aug/2008 12:14:26] {MOVE_FOLDER} Protocol: HTTP/WebMail, User: jpalmer@company.com, IP: 127.0.0.1, Old location: ~jpalmer@company.com/INBOX/Work&AO0-, New location: ~jpalmer@company.com/Deleted Items/Work, Items count: 3

  • [07/Aug/2008 12:14:26] — date and time of the operation (movement of the folder).

  • {MOVE_FOLDER} — operation type. The folder was moved.

  • Protocol — type of protocol used for movement of the item. The protocol type tells us which email client the user accessed the server from.

  • User — the user who moved the folder.

  • IP — IP address of the computer which the operation was executed from.

  • Old location — the original location of the folder.

  • New location — the new location of the folder.

  • Items count — number of items (e.g. emails) included in the folder.