Skip to content

User audit

Track who sent or deleted what in mailboxes and what was done in other people's mailboxes, along with failed sign-in attempts and administrator actions, as searchable records.

Global administratorAdmin console › Tools and Migration › User Audit

Records use the Exchange mailbox audit names: MailboxLogin, Send, SendAs, SendOnBehalf, Create, Copy, Move, MoveToDeletedItems, SoftDelete, HardDelete, Update. Each record includes the acting identity, IP address and client.

Turning auditing on

Auditing is off after installation; an orange "User audit is OFF" notice is shown at the top of the screen.

  1. Open Tools and Migration › User Audit › the Settings tab.
  2. Tick Enable user audit (1). Record failed login attempts is on by default.
  3. Enter the Retention (2, days, 1-3650; default 400). If needed, fill in Only these mailboxes and the IPs not to record (3, for example monitoring servers).
  4. In the Recorded actions per role table (4), choose the actions to record for owner, delegate and admin.
  5. Save at the bottom of the page. The setting takes effect without a restart.

User Audit: Settings tab

User Audit: Settings tab

Several mailbox servers

The setting is per server. Connect the console to the other servers and save the same setting there.

Searching records

  1. Open the Records tab (1).
  2. Fill in the filters: Event (2), Role, Mailbox (3), Performed by, IP address, From, Recipient, Subject, Attachment name, Message-ID, Item ID, From date (4) and To date. Text filters are case-insensitive and combined.
  3. For actions on someone else's mailbox only, tick Only actions on someone else's mailbox (delegate/admin).
  4. Search. Results come newest first (up to 500 records); an identity acting in someone else's mailbox is highlighted. Clear empties the filters.
  5. To download the list, click Export CSV in the toolbar; the file is downloaded directly.

User Audit: searching records

User Audit: searching records

Example: messages an account permanently deleted in the last week. Event: Hard delete (HardDelete); Mailbox: the account; From date: one week ago › Search.

Failed logins and delegated access

  • Failed logins (1): attempts per account; click a row to see time, IP, reason and protocol (http, imap, pop3).
  • Delegated access: actions in someone else's mailbox, with the actor and the target.

Failed logins tab

Failed logins tab

Administrator actions and sessions

  1. Open the Admin & sessions tab (1). Administrator actions (account, password, list, domain, COS and rights changes), an administrator opening a mailbox, sign-ins, failed sign-ins and sign-outs are listed.
  2. Filter by Performed by, Target (account / object) (2), IP address, date range and Category (3).
  3. Search (4). Password fields are masked.
  4. On this tab, Export CSV in the toolbar downloads the list as JSON Lines (.jsonl).

Admin & sessions tab

Admin & sessions tab

An administrator merely viewing an account page is not logged by Zimbra.

Dumpster actions

Dumpster Recovery actions (DumpsterSearch, DumpsterView, DumpsterDownload, DumpsterRecover) appear in the Admin & sessions tab.

  • The Dumpster quick filter lists only these events.
  • The Reference no. (ref) filter searches by the request number entered in the reason dialog. The table and the CSV have reason and ref columns.
  • In the CSV, cells starting with =, +, - or @ get a leading ' (spreadsheet formula-injection guard).
  • Delegated (domain) administrators can query the Dumpster-only history for accounts they hold adminLoginAs on; other audit records remain global-admin only. Mail Trace actions (starting, finishing and cancelling a job, viewing results, downloading the report, changing the authorized list, denied access) also appear on this tab with the acting administrator and the job number (1.2.5).

Command line

As the zimbra user on the server, the same filters are available:

profelis-user-audit-search --others --since 2026-09-01
profelis-user-audit-search --event HardDelete,SoftDelete --account jane.doe@zpe.profelis.net --json

Scope

Opening folders or messages (FolderBind, MessageBind) is not recorded because Zimbra does not report it; marking as read appears as Update. SMTP AUTH attempts are not recorded. Message bodies and attachment contents are not stored; only headers and attachment names.

Personal data

The records contain personal data. Set retention and access according to your organisation's data protection policy.