Enable Extended Logging :: In Exim

[host.co.in]

Hello,

Ironically, my first post

To enable extended loggin in exim to trace nobody mails. Try the following trick .

1. Edit /etc/exim.conf

2. On the second line add :

log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn \

Make sure all that comes on a single line.

3. Save and exit.

4. Restart Exim.

A little bit luck and you should be able to catch the spammer.

Regards,

Piyush.

[Jayesh_M]

Hello,

Use following two script to catch the spammer.

1. exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have from or to the email address in the mail queue with exact figure.

2. exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" |awk -F "@" '{ print $2}' | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have for the domain or from the domain with number.

Also you can try following command that will show you the script which is using script to send the email.

If it is from php then use
/var/spool/exim/input
egrep "X-PHP-Script" * -R
Just cat the ID that you get and you will be able to check which script is here causing problem for you.

That may help you a lot to catch the spammer.

Regards,
Jayesh.M.

[Tukaram]

Hello,

Also check with following commands:

# exim -bpc

This will give you the number of emails available in the queue

#exim -bpr

This will give you the list if email IDs which are currently in queue

If you find the frozen email with mail queue then you have to remove the frozen email with grep frozen.

#exim -bpr | grep frozen | awk {'print $3"} | xargs exim -Mrm ;


Best Regards,
Tuks