# Big ".pag" file in .usermin/Maibox **URL:** \ **Category:** Usermin\ **Created:** [October 30, 2024, 10:43am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139 "2024-10-30T10:43:02Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![bleck](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/b/8dc957/32.png) [@bleck](https://forum.virtualmin.com/u/bleck)\ **Post date:** [October 30, 2024, 10:43am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/1 "2024-10-30T10:43:02Z")
| SYSTEM INFORMATION | | | --- | --- | | OS type and version | Debian Linux 12 | | Webmin version | 2.202 | | Usermin version | 2.102 | Hy, I have found a big “.pag” file in the “/home/DomOwner/.usermin/Mailbox” folder of a domain owner. I don’t know what it’s used for nor what process or user action generates/updates it… -rw------- 1 DomOwner DomOwner 13921280 Oct 16 12:00 home\_DomOwner\_Maildir.byid.findex.pag This file is much bigger (~ 14 MIB) than DomOwner’s mailbox (78.3 KiB). The total size of maiboxes of users declared in the domain (excluding sub-domains) is ~ 65 MiB. Can I delete this big “byid.index.pag” ? Thanks for help. Bleck Here is the content of the Mailbox directory : drwx------ 2 DomOwner DomOwner 4096 Oct 29 19:02 . drwx------ 7 DomOwner DomOwner 4096 May 17 2016 … -rw------- 1 DomOwner DomOwner 0 Oct 29 18:56 1.byid.index.dir -rw------- 1 DomOwner DomOwner 1024 Oct 29 18:57 1.byid.index.pag -rwx------ 1 DomOwner DomOwner 612 Oct 29 18:57 1.virt -rw------- 1 DomOwner DomOwner 4096 Oct 29 18:37 attach.dir -rw------- 1 DomOwner DomOwner 1026048 Oct 29 18:57 attach.pag -rw-r–r-- 1 DomOwner DomOwner 104 Oct 16 11:59 config -rw------- 1 DomOwner DomOwner 4096 Oct 29 18:52 delreplies.dir -rw------- 1 DomOwner DomOwner 2078720 Oct 29 18:57 delreplies.pag -rw------- 1 DomOwner DomOwner 4096 Oct 16 11:58 dsnreplies.dir -rw------- 1 DomOwner DomOwner 1026048 Oct 29 18:57 dsnreplies.pag -rw------- 1 DomOwner DomOwner 4096 Oct 16 11:54 \_home\_DomOwner\_Maildir.byid.findex.dir -rw------- 1 DomOwner DomOwner 13921280 Oct 16 12:00 \_home\_DomOwner\_Maildir.byid.findex.pag -rwx------ 1 DomOwner DomOwner 42 Oct 29 12:23 inbox.imap -rwxr-x— 1 DomOwner DomOwner 6 Oct 29 18:37 lastfolder -rw------- 1 DomOwner DomOwner 0 Aug 21 2011 read.dir -rw------- 1 DomOwner DomOwner 1024 Sep 14 14:22 read.pag ---
**Author:** ![bleck](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/b/8dc957/32.png) [@bleck](https://forum.virtualmin.com/u/bleck)\ **Post date:** [November 7, 2024, 2:26pm UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/2 "2024-11-07T14:26:33Z")
I have made a backup of the file and deleted it. I will see what happens 🤞 It’s a very frustrating way to maintain a server… Can someone tell me where are these “.pag” and “.dir” files documented ? ---
**Author:** ![Stegan](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/stegan/32/6860_2.png) [@Stegan](https://forum.virtualmin.com/u/Stegan)\ **Post date:** [November 7, 2024, 2:36pm UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/3 "2024-11-07T14:36:22Z")
I would be more concrned about where they are coming from. As they are in a mailbox I would guess they are coming in through mail. (_or quite possibly mail being sent via/through a website_) ---
**Author:** ![bleck](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/b/8dc957/32.png) [@bleck](https://forum.virtualmin.com/u/bleck)\ **Post date:** [November 7, 2024, 11:34pm UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/4 "2024-11-07T23:34:02Z")
Thank you Stegan, Some of theses files are updated when the mailbox is accessed through Usermin and the search functionality is used . This way, I could update : _dnsreplies.pag_, _delreplies.pag_, _1.virt_, _1.byid.index.pag_, _attach.pag_ and _lastforder_. All other files where were left untouched, including the big “\_home\_DomOwner\_Maildir.byid.findex.pag” file 😟 Concerning mail content, these files appear in the “mailbox” sub-directory of the user’s **“.usermin” directory**. It seems to be consistent with the fact that some files are modified when the mailbox is accessed through _usermin_ and are untouched when accessed though _imap_. The mailbox content is stored somewhere else, in the /home/DomOwner/Mailbox directory, I guess. ---
**Author:** ![Stegan](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/stegan/32/6860_2.png) [@Stegan](https://forum.virtualmin.com/u/Stegan)\ **Post date:** [November 8, 2024, 9:14am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/5 "2024-11-08T09:14:49Z")
I would still be more concerned about where they are coming from. As I am not seeing them produced (_and I am assuming no one else is either_) I don’t believe this is a product of Virtualmin/Usermin. I think you need to resolve where these are originating from and why. Is it one specific domain? if so what is running on that domain? (what app) ---
**Author:** ![bleck](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/b/8dc957/32.png) [@bleck](https://forum.virtualmin.com/u/bleck)\ **Post date:** [November 8, 2024, 4:17pm UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/6 "2024-11-08T16:17:32Z")
Thanks for your repeated warnings. Really 🙏 Similar files are present in another domain (not sub-domain) _.usermin/mailbox_ directory : ```auto drwx------ 2 owner2 owner2 4096 2024-10-24 16:46 . drwx------ 7 owner2 owner2 4096 2024-09-14 15:25 .. -rw------- 1 owner2 owner2 0 2024-09-14 15:25 attach.dir -rw------- 1 owner2 owner2 1024 2024-09-14 15:25 attach.pag -rw------- 1 owner2 owner2 0 2024-09-14 15:25 delreplies.dir -rw------- 1 owner2 owner2 1024 2024-09-14 15:25 delreplies.pag -rw------- 1 owner2 owner2 0 2024-09-14 15:25 dsnreplies.dir -rw------- 1 owner2 owner2 1024 2024-09-14 15:25 dsnreplies.pag -rw-r--r-- 1 owner2 owner2 38 2024-10-24 16:46 inbox.imap -rw-r--r-- 1 owner2 owner2 5 2024-09-14 15:25 lastfolder ``` After connecting to Virtualmin as _root_ and navigating to _domain \> users \> onwner2 \> Login to Usermin_, I got a error message : ![Screenshot_20241108_163952](https://cdn.forum.virtualmin.com/uploads/default/original/3X/d/4/d478bff966238c5c4d633668611085c15074d33d.png) I suppose the error message and the login prompt are legitimate since _root_ is not supposed to be able to read user’s mail (not this way). Am I right ? Or course, I couldn’t give the password but some existing files were updated : ```auto -rw------- 1 owner2 owner2 1024 2024-11-08 16:39 delreplies.pag -rw------- 1 owner2 owner2 1024 2024-11-08 16:39 dsnreplies.pag -rw------- 1 owner2 owner2 1024 2024-11-08 16:39 attach.pag -rw-r--r-- 1 owner2 owner2 6 2024-11-08 16:39 lastfolder ``` **What is running on the domains and sub-domains onwned by “owner2” and “DomOwner” ?** Both domains run PHP Web widespread applications and manage mail for their users. Users access mail using IMAP or POP but don’t use Usermin interface. It wasn’t clear to me why no one answered me. I understand that the reason is that these files do not exist in any clean running installation of Webmin/Virtualmin/Usermin. Really ? 😟 I guess it’s hard to accept but I may have to assume that this server has been compromised. In this case, it would be pretty serious since the code that generates/updates files such as " _1.byid.index.pag_" is triggered through the Usermin interface 😰 ---
**Author:** ![Stegan](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/stegan/32/6860_2.png) [@Stegan](https://forum.virtualmin.com/u/Stegan)\ **Post date:** [November 8, 2024, 4:46pm UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/7 "2024-11-08T16:46:41Z")
> [@bleck](#): > > but don’t use Usermin interface. OK. for me that just about confirms that it is not a bug in Usermin. > [@bleck](#): > > may have to assume that this server has been compromised. Not yet! - just because some thing rogue is getting in through an email does not mean it has broken everything. > [@bleck](#): > > domains run PHP Web widespread applications and manage mail for their users. I’d concentrate on stopping/limiting those apps/users (temporarily) to determine if they are at fault. Are they using a specific mail program - well maintained. can you catch them using logging? why is the app generating these files what is/was their purpose. is it some alien plugin to the app? does the app have a community support page? ---
**Author:** ![adxadx](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@adxadx](https://forum.virtualmin.com/u/adxadx)\ **Post date:** [November 19, 2024, 9:12am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/8 "2024-11-19T09:12:10Z")
Same here. It’s 2 gigs. \etc\webmin\mailboxes\_var\_mail\_root.findex.{my servername}.pag I deleted a massive amount of unread log emails using Webmin read user mail recently (but not that much), I suspect it isn’t a recent thing because I haven’t noticed a sudden increase in disk usage. I’ve been trying to find what’s been using space, but only when moving / decommissioning the server using rsync and inspecting the files on a Win box did I find it. No sign the server has been compromised, I think I’ll just delete the file(s) and resync. Edit: Actually I think I deleted the mailfile because there was too much to select in Webmin (only a page at a time, and there were something like 19000 pages of emails). Webmin says there is no mail for root. ---
**Author:** ![Steini](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/steini/32/19731_2.png) [@Steini](https://forum.virtualmin.com/u/Steini)\ **Post date:** [November 19, 2024, 9:44am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/9 "2024-11-19T09:44:39Z")
Is this of any help? > [@space problem procmail.cache.pag](https://forum.virtualmin.com/t/space-problem-procmail-cache-pag/46839/3): > > Howdy, This is an odd area where it looks like it’s a problem, but it isn’t actually a problem slight_smile The file isn’t as large as it looks… if you run this command, you can get an accurate size: du -hs /var/webmin/procmail.cache\* Virtualmin uses this file to store parsed email logs for faster searching. If you want to remove it, you can… but it will be re-generated when you try to search mail logs via Virtualmin. It’s a special type of file, called a sparse dbm file. It utilizes spac… ---
**Author:** ![bleck](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/b/8dc957/32.png) [@bleck](https://forum.virtualmin.com/u/bleck)\ **Post date:** [November 19, 2024, 10:17am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/10 "2024-11-19T10:17:58Z")
Thank you Steini, Yes, it’s very helpful. New “.pag” files a generated if I use the _search_ functionality of the Mail interface of Usermin. At least, they are not generated by an unknown program running on the server. I didn’t check the real size of the file when is still was in the server’s file system. But I notice that the compressed backup is 359 kib only while the file was supposed to use 13.921.280 bytes (according to “ls”). What you report reminds the same kind of sizes difference between declared and used, in other cases of temporary index files. ---
**Author:** ![bleck](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/b/8dc957/32.png) [@bleck](https://forum.virtualmin.com/u/bleck)\ **Post date:** [November 19, 2024, 10:40am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/11 "2024-11-19T10:40:03Z")
Thank you adxadx, I remember I made a search in this mailbox once it contained thousands of mails. I didn’t delete the mailbox but I removed the unwanted messages through the Webmin\>Servers\>Postfix\>User Mailboxes interface (instead of Usermin\>Mail interrface). Don’t know if it explains something… ---
**Author:** ![bleck](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/b/8dc957/32.png) [@bleck](https://forum.virtualmin.com/u/bleck)\ **Post date:** [November 19, 2024, 10:55am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/12 "2024-11-19T10:55:20Z")
I have made a test… 1. logged off Usermin (as the user who owns this mailbox) 2. backuped/removed the content of the .usermin/mailbox directory 3. logged in to the mailbox through Usermin (no mail was lost) ; it created a limited list of very small or empty files : - attach.dir - attach.pag - delreplies.dir - delreplies.pag - dsnreplies.dir - dsnreplies.pag - inbox.imap - lastfolder 1. made a search through Usermin ; which generated 3 knew small or empty files : - 1.byid.index.dir - 1.byid.index.pag - 1.virt I will continue checking if strange files appear during the next weeks… ---
**Author:** ![system](https://cdn.forum.virtualmin.com/uploads/default/original/2X/c/cd96d761e326db4b2bef94886a639109bd7a8e76.svg) [@system](https://forum.virtualmin.com/u/system)\ **Post date:** [January 18, 2025, 10:56am UTC](https://forum.virtualmin.com/t/big-pag-file-in-usermin-maibox/130139/13 "2025-01-18T10:56:19Z")
Closed on January 18, 2025, 10:56am UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.