[Mailman-Users] Users being unsubscribed without requesting it.

[Andy Cravens]

On Aug 19, 2017, at 8:27 AM, Steve Wehr <steve at tunedinweb.com> wrote:


subscribe:Aug 18 00:41:10 2017 (22583) saintsofswing: deleted
dorrainescofield at gmail.com; via the member options page




Steve, if this was done via the web interface the first thing I would do is get the date/timestamp for the log entry “deleted via the member options page.”   Next, search through your apache logs looking for that same date/timestamp.  You should be able to find the exact apache access log entry with that date and time down to the second where someone submitted the form to remove the user.  Your apache log should contain the IP address of the client who submitted the form.  Finally, look up that IP address to see who owns it.  You could also grep for that IP address to get all the access logs for that user to see what else they are up to.  This would allow you to track down the client responsible for unsubscribing that address.

—
Andy