"proving" a user received an email (good gosh)

From: gaius.petronius (rut@linuxmail.org)
Date: 06/24/02 

From: rut@linuxmail.org (gaius.petronius)
Date: 23 Jun 2002 23:45:03 -0700

"proving" a user received an email (good gosh)

boss calls me in
manager X is a liar, says he never received this damn email.

i check the logs

i see an entry about the time sender claims it was sent:

exhibit A
maillog:
Jun 22 23:47:31 swm sendmail[5517]: g5MFlUu05517:
from=<sender@address>, size=5988, class=0, nrcpts=2,
msgid=<4778858448D8547D4A54BCC6118467D@>, proto=ESMTP, daemon=MTA

i also see in
exhibit B
maillog:
Jun 22 23:47:31 swm sendmail[5518]: g5MFlUu05517: to=<BigLiar>,
delay=00:00:00, xdelay=00:00:00, mailer=local, pri=65536, dsn=2.0.0,
stat=Sent
maillog:Jun 22 23:47:31 swm sendmail[5518]: g5MFlUu05517:
to=<AngryBOSS>, delay=00:00:00, xdelay=00:00:00, mailer=local,
pri=65536, dsn=2.0.0, stat=Sent

i see that the user also checked his email without errors

exhibit C
maillog:Jun 23 23:31:48 swm ipop3d[12224]: Login user=BigLiar
host=4.unknown.com [227.1.0.n] nmsgs=2/2

My question is, although i know that this 22:23:47:31 is most probably
the mail in question, how can i link it to the message id
78858448D8547D4A54BCC6118467D@ ??

This is probably more a security or forensics question.
is there a way to tune the logs to report the message id of the email
when the user logs in and receives?

in exhibit C there is no apparent way i can say that he is receiving
this particular message; all i can say is that the server is
functioning properly and that there is no reason to doubt that when he
logged in he did not receive all his email messages.

is there a method to log the received message id?

Relevant Pages

  • Re: "proving" a user received an email (good gosh)
    ... >This is probably more a security or forensics question. ... >is there a way to tune the logs to report the message id of the email ... >in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • Re: "proving" a user received an email (good gosh)
    ... >This is probably more a security or forensics question. ... >is there a way to tune the logs to report the message id of the email ... >in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • "proving" a user received an email (good gosh)
    ... This is probably more a security or forensics question. ... is there a way to tune the logs to report the message id of the email ... in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • Re: "proving" a user received an email (good gosh)
    ... | is there a way to tune the logs to report the message id of the email ... | in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)
  • Re: "proving" a user received an email (good gosh)
    ... | is there a way to tune the logs to report the message id of the email ... | in exhibit C there is no apparent way i can say that he is receiving ...
    (comp.security.unix)