The Operations log gathers information about removed and moved items (messages, contacts, events, tasks and notes) in user mailboxes. It is helpful especially if a user does not manage to find a particular message in their mailbox. The log tells us whether the desired message has not been removed.
In addition to the items related information, the log also includes information about removing and moving any folders in mailboxes.
Besides removals, the log also gathers information about moving folders (it treats them as subfolders removed from the particular folder). Moving of folders is marked by a special flag.
The information is recorded following this pattern:
[07/Aug/2008 11:07:02] {DELETE} Protocol:
HTTP/WebMail, User: wsmith@company.com, IP: 127.0.0.1, Folder:
~wsmith@company.com/Deleted Items, From: "Winston Smith"
<wsmith@company.com>, Subject: "Vacations", Delivered: 07/Aug/2008
11:05:27, Size: 1320
[07/Aug/2008 11:07:02]
— date and
time of the operation (moving or removing of an item).
{DELETE}
— operation type. The item
was removed or moved.
Protocol
— type of protocol used for
removal or moving of the item. The protocol type tells us by which email client
the user accessed the server (examples: HTTP/WebMail — the Kerio WebMail
interface, SYSTEM — automatic deletion of items, HTTP/WebDAV —
MS Outlook extended with Kerio Outlook
Connector or MS Entourage).
User
— user mailbox where the
operation took place.
IP
— IP address of the computer
which the operation was executed from.
Folder
— the folder where the
operation took place.
Subject
— subject of the item.
Delivered
— date of delivery of the
item in case of emails.
Size
— size of the item.
[07/Aug/2008 12:14:57] {DELETE_FOLDER}
Folder: ~jpalmer@company.com/Deleted Items/Work deleted
[07/Aug/2008 12:14:57]
— date and
time of the operation (removal of the folder).
{DELETE_FOLDER}
— operation type.
The folder was removed.
Folder
— name of the deleted folder.
deleted
— operation.
[07/Aug/2008 12:14:26] {MOVE_FOLDER}
Protocol: HTTP/WebMail, User: jpalmer@company.com, IP: 127.0.0.1, Old location:
~jpalmer@company.com/INBOX/Work&AO0-, New location:
~jpalmer@company.com/Deleted Items/Work, Items count: 3
[07/Aug/2008 12:14:26]
— date and
time of the operation (movement of the folder).
{MOVE_FOLDER}
— operation type. The
folder was moved.
Protocol
— type of protocol used for
movement of the item. The protocol type tells us which email client the user
accessed the server from.
User
— the user who moved the
folder.
IP
— IP address of the computer
which the operation was executed from.
Old location
— the original location
of the folder.
New location
— the new location of
the folder.
Items count
— number of items (e.g.
emails) included in the folder.