This can (optionally) contain data showing how messages have been handled (eg deleted, moved, etc)

• id - incrementing ID of msgaudit entry
• datetime - the date & time the event occurred
• component - which VPOP3 component performed the event
• owner - which VPOP3 user owned the message
• actionuser - which VPOP3 user performed the event
• cmd - the command which occurred
• ipaddr - the IP address the event was triggered by
• sourcefolder - the folder the message was in at the start of the event
• targetfolder - the folder the message was in at the end of the event (if it was different from the sourcefolder)
• subject - the message subject
• sender - the message sender
• msgdate - the message date

Note that this logs commands sent to VPOP3's message store, NOT commands sent by the user, so it may not match what you think is happening. For instance, if a user deletes a message, you may see a copy to another folder (eg 'Trash'), then a bit later a message delete, then a bit later a message purge/expunge. That is how the 'delete' operation is actually performed in the background.

• DIST - message distributor (eg incoming message)
• I - IMAP4 service
• IMP - message importer
• LUA - Lua script
• OFFREST - Offsite backup restorer
• P - POP3 service
• REST - database backup restorer
• S3 - Amazon S3 restorer
• SETS - setting change
• W - Webmail/admin

• A - append message (upload message from IMAP4 client to VPOP3)
• C - copy message
• D - delete message
• E - expunge folder (delete all messages with the IMAP4 'delete' flag set)
• K - create folder
• M - move message
• P - purge message
• R - rename folder
• U - undelete message
• X - delete folder
• Y - move all messages from one folder to another
• Z - purge all messages (eg from Admin settings)