Re: "proving" a user received an email (good gosh)

From: Yuan Liu (yliu@stemnet.nf.ca)
Date: 06/24/02 

From: Yuan Liu <yliu@stemnet.nf.ca>
Date: Mon, 24 Jun 2002 07:22:24 GMT

gaius.petronius wrote:

> "proving" a user received an email (good gosh)
>
> boss calls me in
> manager X is a liar, says he never received this damn email.
>
> i check the logs
>
> i see an entry about the time sender claims it was sent:
>
> exhibit A
> maillog:
> Jun 22 23:47:31 swm sendmail[5517]: g5MFlUu05517:
> from=<sender@address>, size=5988, class=0, nrcpts=2,
> msgid=<4778858448D8547D4A54BCC6118467D@>, proto=ESMTP, daemon=MTA
>
> i also see in
> exhibit B
> maillog:
> Jun 22 23:47:31 swm sendmail[5518]: g5MFlUu05517: to=<BigLiar>,
> delay=00:00:00, xdelay=00:00:00, mailer=local, pri=65536, dsn=2.0.0,
> stat=Sent
> maillog:Jun 22 23:47:31 swm sendmail[5518]: g5MFlUu05517:
> to=<AngryBOSS>, delay=00:00:00, xdelay=00:00:00, mailer=local,
> pri=65536, dsn=2.0.0, stat=Sent
>
> i see that the user also checked his email without errors
>
> exhibit C
> maillog:Jun 23 23:31:48 swm ipop3d[12224]: Login user=BigLiar
> host=4.unknown.com [227.1.0.n] nmsgs=2/2
>
>
> My question is, although i know that this 22:23:47:31 is most probably
> the mail in question, how can i link it to the message id
> 78858448D8547D4A54BCC6118467D@ ??
>
> This is probably more a security or forensics question.
> is there a way to tune the logs to report the message id of the email
> when the user logs in and receives?
>
> in exhibit C there is no apparent way i can say that he is receiving
> this particular message; all i can say is that the server is
> functioning properly and that there is no reason to doubt that when he
> logged in he did not receive all his email messages.
>
> is there a method to log the received message id?
>

There are software that log all received messages, if that's what you
are after (some companies do this for legal purposes, especially those
dealing with financial transactions). But simper, you may set up an MDA
such as procmail to extract message ID of each E-mail it delivers.

None of these will be helpful in a cas passé, of course.

Yuan Liu

Relevant Pages

  • Re: "proving" a user received an email (good gosh)
    ... >This is probably more a security or forensics question. ... >is there a way to tune the logs to report the message id of the email ... >in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • Re: "proving" a user received an email (good gosh)
    ... >This is probably more a security or forensics question. ... >is there a way to tune the logs to report the message id of the email ... >in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • "proving" a user received an email (good gosh)
    ... This is probably more a security or forensics question. ... is there a way to tune the logs to report the message id of the email ... in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • "proving" a user received an email (good gosh)
    ... This is probably more a security or forensics question. ... is there a way to tune the logs to report the message id of the email ... in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • Re: "proving" a user received an email (good gosh)
    ... | is there a way to tune the logs to report the message id of the email ... | in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)