Finding Inactive users in 30 minutes.

Question

I use this technique to find iplanet 5.x inactive users.
NOTE: In each mailbox root there is a file store.idx which get update everytime a new message recieved.
find /your/path/to/store/partition/primary/=user -mtime +45 -name store.idx -type f > inactive
this will put all inatcive mailboxes paths which are inactive from last 45 days in a new file "inactive"
the result will similer to
/your/path/to/store/partition/primary/=user/57/21/=aliejaz1/store.idx
then i use these commands to remove useless lines which refer to Sent, Draft and Trash folders.
grep -v Sent inactive > SentRemoved
grep -v Draft SentRemoved > DraftRemoved
grep -v Trash DraftRemoved > TrashRemoved
grep -v + TrashRemoved > CustomFoldersRemoved
Then I also manualy remove all those lines which refer to remaining Custom Folders.
Then by using Find and Replace I replace /your/path/to/store/partition/primary/=user/ with space.
Now it becomes like 57/21/=aliejaz1/store.idx
then I also replace store.idx with space and result become like 57/21/=aliejaz1
Now I replace = with comma i-e , and results become 57/21/,aliejaz1
then I use Excel and open final file as csv.
It will paste 57/21/ in first column and aliejaz1 in second column.
Delete the whole first column.
Now the excel file only contains inactive userids.
That way I found my inactive users.
Good Luck.
Note that if a user still recieving email or spam then it cannot be find this way but there is a chance that his mailbox 100% filled along time ago due to inactivity
I found 90% inactive users by using this mechanism.
For remaining else users check your logs.

Answer 1

Hi,
I would highly recommend against other customers using this approach for a few reasons:
1. A 'find' across the entire store can impact the inode-cache and overall disk performance substantially. A better approach would be to parse the "last msg date" out of the output of "./mboxutil -l" or even "./mboxutil -lp user/%/INBOX" if you just cared about the INBOX. This will cater for users who haven't had a new email for 45 days in their INBOX.
2. Doesn't cater for the case where a user is forwarding their email; the mailbox/account is 'active' just that the contents may not have changed.
3. Doesn't cater for accounts that haven't received new email in 45 days but the user is still reading the old emails - reading an email only updates the store.usr file, the store.idx is only changed if the email is deleted/expunged.
4. Doesn't cater for accounts that are used as 'public shared folders' where emails may only be delivered to very occasionally and not deleted.
In MS6.3 there is another mechanism to monitor when a customer last accessed their account; the ./imsconnutil command e.g.
# ./imsconnutil -a -u shjorth
UID                   IMAP last access                HTTP last access              POP last access
===================================================================================================
shjorth               07/Nov/2007:11:42:57              ----NOT-RECORDED----               ----NOT-RECORDED----Given that iMS5.2 is now in limited support you should be upgrading to MS6.3 anyway.
Regards,
Shane.