<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Mail Disclaimers on 11:57:01 Thursday, 28 March 2024 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.imprintuniqueid, li.imprintuniqueid, div.imprintuniqueid
{mso-style-name:imprintuniqueid;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<p class="ImprintUniqueID"></p>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Maybe the log rotation happened upon the server updating it’s date/time via NTP on bootup and since it was more than 7 days old based on current time it rotated
them?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Just a thought.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div></div>
</div>
<p></p>
<p class="ImprintUniqueID"> </p>
<p class="ImprintUniqueID">
<table class="ImprintUniqueIDTable" style="WIDTH: 100%; BORDER-COLLAPSE: collapse" cellspacing="0" cols="2" cellpadding="0" border="0">
<tbody>
<tr>
<td style="WIDTH: 187px" valign="bottom" width="170">
<p class="ImprintUniqueID"> </p>
<p class="ImprintUniqueID"><img src="http://images.pattishall.com/images/pattishalllogo.jpg"></p>
</td>
<td style="WIDTH: 538px" width="550">
<p class="ImprintUniqueID"> </p>
<p class="ImprintUniqueID"><font size="2" face="arial"><br>
Dale E. Qualls <br>
Director of Information Technology<br>
Pattishall, McAuliffe, Newbury, Hilliard & Geraldson LLP<br>
200 South Wacker Drive, Suite 2900<br>
Chicago, IL 60606-5896<br>
Direct: (312) 554-7979 Main: (312) 554-8000 Fax: (312) 554-8015<br>
<a href="mailto:deq@pattishall.com" title="Click to send email to Dale E. Qualls" target="" style="">deq@pattishall.com</a>
<a href="http://www.pattishall.com">www.pattishall.com</a></font> </p>
</td>
</tr>
<tr>
<td></td>
<td><font size="2" face="arial"></font></td>
</tr>
</tbody>
</table>
</p>
<p class="ImprintUniqueID"></p>
<p class="ImprintUniqueID"> </p>
<hr id="HR1">
<p class="ImprintUniqueID"><font size="1" face="Arial"><font face="Franklin Gothic Medium">The preceding message and any attachments may contain confidential information protected by the attorney-client or other privilege. You may not forward this message or
any attachments without the permission of the sender. If you believe that it has been sent to you in error, please reply to the sender that you received the message in error and then delete it. Nothing in this email message, including the typed name of the
sender and/or this signature block, is intended to constitute an electronic signature unless a specific statement to the contrary is included in the message</font>.</font>
</p>
<hr id="HR1">
<p class="ImprintUniqueID"> </p>
<p class="ImprintUniqueID"></p>
<div class="WordSection1">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> ZendTo <zendto-bounces@zend.to>
<b>On Behalf Of </b>Elston, Ian via ZendTo<br>
<b>Sent:</b> Thursday, March 28, 2024 11:53 AM<br>
<b>To:</b> ZendTo Users <zendto@zend.to><br>
<b>Cc:</b> Elston, Ian <I.Elston@bolton.ac.uk><br>
<b>Subject:</b> [ZendTo] Interesting issue with historical logging/resurrecting old zendto from backup<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="imprintuniqueid"><span style="color:red">External email, exercise caution.</span><o:p></o:p></p>
<p class="imprintuniqueid"> <o:p></o:p></p>
<p class="imprintuniqueid">Had an interesting issue the last couple of days, wondered if anyone had run into similar.<br>
<br>
As high-up user asked me if there was a way of checking the activity around a particular drop off, what was uploaded when, and downloaded when by who. This was back at the end of Jan. We delete drop-offs after 7 days.<br>
<br>
The zendto.log on the live server did not go back far enough (maybe I need to amend my log rotation settings here...) so I restored the logs off a backup from within 7 days of the drop-off being made. I knew the uploader and the recipient, so I was able to
find the drop-off ID and therefore all the corresponding log entries.<br>
<br>
From zendto.log I was able to ascertain the time of upload, the IP Address of the upload, the fact there were 3 files in the upload (but not the filenames), and that the email was sent to the recipient. I could then determine when the files were downloaded
and from what IP Address. Either 1 single file was downloaded, or the entire drop-off in an entire zip file. So I know for certain the name of ONE of the files.<br>
<br>
What I've been asked is if I can evidence the names of the files which were uploaded, as the user recalls there should've been 4.<br>
<br>
I've tried to recover the server from backup within that 7day period, changed it's IP, switched from SAML to local authenticator, and I can log in as a local user who is an admin. BUT the zendto.log is empty aside from today's entries, and there are no drop-offs
listed, but in the filesystem there are drop-offs, including the one I'm interested in in /var/zendto/drop-offs<br>
<br>
I'm assuming the filenames are randomised in the filesystem for privacy, which I sort of understand.<br>
<br>
What I don't get is why my zendto log is empty, and I have no drop-offs in the UI.<br>
<br>
<br>
<br>
-----------------------------------------------<br>
Ian Elston<br>
Senior Networks officer<br>
Information Systems & Technology<br>
The University of Bolton<br>
<a href="http://www.bolton.ac.uk">http://www.bolton.ac.uk</a><br>
<br>
[University of Bolton]<<a href="https://www.bolton.ac.uk">https://www.bolton.ac.uk</a>><br>
<br>
This email (and any attachments) is confidential and may contain personal views which are not the views of the University of Bolton unless specifically stated. If you have received it in error, please delete it from your system. Do not use, copy or disclose
information in any way nor act in reliance on it and notify the sender immediately. Please note the University of Bolton monitors emails sent or received. Further communication will signify your consent to this.<br>
<br>
_______________________________________________<br>
ZendTo mailing list<br>
<a href="mailto:ZendTo@zend.to">ZendTo@zend.to</a><br>
<a href="http://jul.es/mailman/listinfo/zendto">http://jul.es/mailman/listinfo/zendto</a><o:p></o:p></p>
<p class="imprintuniqueid"> <o:p></o:p></p>
<p class="imprintuniqueid"> <o:p></o:p></p>
</div>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
</body>
</html>