Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » Events deleted in Calendars (Random events deleted by Kerio Connect)
  •  
VWAdministrator

Messages: 10
Karma: 0
Send a private message to this user
Hi all

I'm wondering if anyone else is experiencing random events being deleted in a public Calender. We have seen this a few times and not been able to come up with an answer. Below are a couple of log entries that show the deletions at 17:19 and 17:42 yesterday. Yesterday being a bank holiday no human is putting their hands up for these deletions.

Kerio Connects internal IP address is 192.1.1.245. The Calendar is used to track staff holidays. The Calendar has many events on days either side and on the dates that these events where deleted. Only these two events have been deleted...it seems very random.

Does anyone have an explanation?

Many thanks
Ian

----

[01/Apr/2013 17:19:20] {DELETE} Protocol: HTTP/WebMail, User: administrator<_at_>vwgraphics.co.uk, IP: 192.1.1.245, Folder: #public/Calendars/Holidays, Subject: "Paul Taylor holiday", Delivered: 28/Mar/2013 14:57:57, Size: 1168
[01/Apr/2013 17:19:25] {DELETE} Protocol: HTTP/WebMail, User: administrator@vwgraphics.co.uk, IP: 192.1.1.245, Folder: ~administrator<_at_>vwgraphics.co.uk/Deleted Items, Subject: "Paul Taylor holiday", Delivered: 28/Mar/2013 14:57:57, Size: 1168

[01/Apr/2013 17:45:56] {DELETE} Protocol: HTTP/WebMail, User: administrator<_at_>vwgraphics.co.uk, IP: 192.1.1.245, Folder: #public/Calendars/Holidays, Subject: "Heather Holiday 12.06", Delivered: 13/Feb/2013 09:12:52, Size: 1192
[01/Apr/2013 17:46:11] {DELETE} Protocol: HTTP/WebMail, User: administrator@vwgraphics.co.uk, IP: 192.1.1.245, Folder: ~administrator<_at_>vwgraphics.co.uk/Deleted Items, Subject: "Heather Holiday 12.06", Delivered: 13/Feb/2013 09:12:52, Size: 1192
  •  
Lisa Lyons (Kerio)

Messages: 175
Karma: 8
Send a private message to this user
Hi, Ian

This is not an automated delete (these show up as User Agent, not as a specific user). Since the source IP is the IP of the physical machine your Connect server is running on, this would indicate someone with a remote desktop (or VNC?) connection into the server itself had logged in and deleted the entries over Webmail.

A suggestion is, you might want to change the Administrator's password, then see who requests the new password, this would allow you to control who can therefore log in.

There is no reason or method that could be used to automate these deletions and generate the exact same log entries that you have provided us with.

Kerio Technical Support
Log Support Incidents here: http://www.kerio.com/support
Also, please use our KB: http://kb.kerio.com
Previous Topic: Calendar Events disappeared
Next Topic: Public Folder Disappeared in Webmail 8.0.2
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Tue Oct 17 22:15:04 CEST 2017

Total time taken to generate the page: 0.00430 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.