message posted from /var/log/qmail/smtp/current doesnot having any information regarding this issue
Step 1. #qmailctl queue it will show the mails in queue. Say for example, i am pasting the output you have posted in first mail. 21 Jun 2010 22:45:02 GMT #3087267 1435 <[email protected]> remote [email protected] 21 Jun 2010 22:34:44 GMT #3069258 1430 <[email protected]> remote [email protected] 21 Jun 2010 22:44:39 GMT #3079585 1439 <[email protected]> remote [email protected] 22 Jun 2010 00:02:57 GMT #2443198 1438 <[email protected]> remote [email protected] select a mail id which is in 'remote' field. for example let us take, [email protected]. <[email protected]> Step 2. Use the grep command to search the mailid we collected in the first field. grep -i '[email protected]' /var/log/qmail/smtp/current if no results found, check time of the mail in queue (21 Jun 2010 22:45:02) for this mail. if so check the log file which is having this time stamp. To do this, go to /var/log/qmail/smtp/ #cd /var/log/qmail/smtp/ #ll or # ls -l check the log file for appropriate date and time. If anything does not work, use, grep -i '[email protected]' /var/log/qmail/smtp/* grep -i '[email protected]' /var/log/qmail/submission/* This may take long time and server resource. It will show the log for origin of the mail. --Senthilvel. On Tue, Jun 22, 2010 at 6:16 PM, Rafael Andrade <[email protected]>wrote: > Same time in /var/log/qmail/smtp/current show this log: > > @400000004c20ae8b0e33b054 CHKUSER accepted null sender: from <::> remote > <eslovenia.intralesc.sc.gov.br:unknown:200.192.66.25> rcpt <> : accepted > null sender always > @400000004c20ae8c09af4944 tcpserver: status: 14/100 > @400000004c20ae8c09af5114 tcpserver: pid 8948 from 123.127.247.104 > @400000004c20ae8c09af54fc tcpserver: ok 8948 > net:10.1.1.254:25:123.127.247.104: > :55903 > @400000004c20ae90008f12f4 CHKUSER accepted null sender: from <::> remote > <exchange.lvcgroup.com:unknown:123.127.247.104> rcpt <> : accepted null > sender always > @400000004c20ae920602eae4 tcpserver: status: 15/100 > @400000004c20ae920602f2b4 tcpserver: pid 8950 from 200.228.168.2 > @400000004c20ae920602f69c tcpserver: ok 8950 net:10.1.1.254:25:200.228.168.2: > :52084 > @400000004c20ae92225def7c tcpserver: end 8948 status 0 > @400000004c20ae92225df74c tcpserver: status: 14/100 > @400000004c20ae931ac30d24 CHKUSER accepted null sender: from <::> remote > <server.aceam.unb.org.br:unknown:200.228.168.2> rcpt <> : accepted null > sender always > > in /var/log/maillog > > Jun 22 09:37:27 net spamdyke[8948]: DENIED_RDNS_MISSING from: (unknown) to: > [email protected] origin_ip: 123.127.247.104 origin_rdns: (unknown) > auth: (unknown) > Jun 22 09:37:29 net spamdyke[8950]: DENIED_RDNS_MISSING from: (unknown) to: > [email protected] origin_ip: 200.228.168.2 origin_rdns: (unknown) > auth: (unknown) > Jun 22 09:37:44 net spamdyke[8952]: DENIED_RDNS_MISSING from: (unknown) to: > [email protected] origin_ip: 200.228.168.2 origin_rdns: (unknown) > auth: (unknown) > Jun 22 09:38:03 net spamdyke[8954]: DENIED_RDNS_MISSING from: (unknown) to: > [email protected] origin_ip: 195.235.66.91 origin_rdns: (unknown) > auth: (unknown) > > > > ________________________________________________________________________________________________________________________________ > Rafael Andrade <http://www.riosulense.com.br> > ...Administrador de Sistemas > > . 47 3531-4152 > > > Antes de imprimir, pense em sua responsabilidade e compromisso com o Meio > Ambiente! > > > > > > > > > > > > > > > senthil vel escreveu: > >> Honestly, I am not using, spamdyke. Does spamtyke appends all the log to >> /var/log/maillog? also seems spamdyke is rejecting these mails. Is this >> current log? if so somebody still sending mails. Can't you get any >> information from /var/log/qmail/smtp/current regarding this? >> >> On Tue, Jun 22, 2010 at 5:43 PM, Rafael Andrade >> <[email protected]<mailto: >> [email protected]>> wrote: >> >> Look in /var/log/maillog >> >> Jun 22 09:02:10 net spamdyke[5028]: DENIED_RDNS_MISSING from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 189.2.134.108 >> >> origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:02:11 net spamdyke[5024]: DENIED_RDNS_MISSING from: >> [email protected] >> <mailto:[email protected]> to: >> [email protected] <mailto:[email protected]> origin_ip: >> >> 79.189.227.34 origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:02:14 net spamdyke[5025]: DENIED_RDNS_MISSING from: >> [email protected] <mailto:[email protected]> to: >> [email protected] <mailto:[email protected]> origin_ip: >> >> 80.184.67.122 origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:02:14 net spamdyke[5026]: DENIED_RDNS_RESOLVE from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 209.113.141.35 >> origin_rdns: mlsvr01.mindleaf.com <http://mlsvr01.mindleaf.com> >> >> auth: (unknown) >> Jun 22 09:02:44 net spamdyke[5033]: DENIED_RDNS_MISSING from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 200.143.203.70 >> >> origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:02:50 net spamdyke[5032]: DENIED_OTHER from: >> [email protected] <mailto:[email protected]> to: >> [email protected] <mailto:[email protected]> >> >> origin_ip: 200.185.80.78 origin_rdns: smtp4.votorantim.com.br >> <http://smtp4.votorantim.com.br> auth: (unknown) >> >> Jun 22 09:03:09 net spamdyke[5043]: DENIED_RDNS_MISSING from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 202.181.238.101 >> >> origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:03:26 net spamdyke[5046]: DENIED_RDNS_MISSING from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 200.14.68.55 >> >> origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:03:30 net spamdyke[5050]: DENIED_RDNS_MISSING from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 200.228.168.2 >> >> origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:03:42 net spamdyke[5106]: DENIED_RDNS_MISSING from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 200.228.168.2 >> >> origin_rdns: (unknown) auth: (unknown) >> Jun 22 09:03:53 net spamdyke[5108]: DENIED_RBL_MATCH from: >> (unknown) to: [email protected] >> <mailto:[email protected]> origin_ip: 201.76.223.15 >> origin_rdns: send.wnetrj.com.br <http://send.wnetrj.com.br> auth: >> >> (unknown) >> >> >> The ips are spoofing? >> Actually im not using 587 port >> Im using vpopmail to auth my users. >> >> Thanks so much!! >> >> >> >> >> senthil vel escreveu: >> >> Seems some one is spamming. Any one of your mail account might >> be compromised. The server is using port 587 to accept mails >> from local users? . /var/log/qmail/submission or >> /var/log/qmail/smtp will tell the truth. >> >> say for example, search for "[email protected] >> <mailto:[email protected]> >> <mailto:[email protected] >> >> <mailto:[email protected]>>" in above mentioned logs. >> So that we can get the origination of this mail. If it is >> using a local mail id for authentication, reset the password >> of the mail. Also remove the mails in queue using qmail-remove. >> >> --Senthilvel. >> >> >> On Tue, Jun 22, 2010 at 4:29 PM, Rafael Andrade >> <[email protected] <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>>> wrote: >> >> Hello list, >> >> I have a production server with qmailtoaster on centos >> running 2 >> years perfectly, recently the server stuck, with many >> messages in >> queue, i need to stop qmail, clean the queue and running qmail >> again, but i need a solution to fix this problem, any knows >> or can >> help? >> >> Thanks so much >> >> Examples in queue: >> >> Client = Hide Client Domain >> >> [r...@net ~]# qmailctl queue | head >> messages in queue: 14691 >> messages in queue but not yet preprocessed: 2 >> 21 Jun 2010 22:45:02 GMT #3087267 1435 >> <[email protected] <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>>> >> remote [email protected] >> <mailto:[email protected]> >> <mailto:[email protected] <mailto:[email protected]>> >> >> >> 21 Jun 2010 22:34:44 GMT #3069258 1430 >> <[email protected] <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>>> >> remote [email protected] >> <mailto:[email protected]> <mailto:[email protected] >> >> <mailto:[email protected]>> >> >> 21 Jun 2010 22:44:39 GMT #3079585 1439 >> <[email protected] <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>>> >> >> remote [email protected] >> <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>> >> >> 22 Jun 2010 00:02:57 GMT #2443198 1438 >> <[email protected] <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>>> >> remote [email protected] >> <mailto:[email protected]> >> <mailto:[email protected] >> >> <mailto:[email protected]>> >> >> >> Thanks so much >> >> >> >> >> >> --------------------------------------------------------------------------------- >> Qmailtoaster is sponsored by Vickers Consulting Group >> (www.vickersconsulting.com >> <http://www.vickersconsulting.com> >> <http://www.vickersconsulting.com>) >> >> Vickers Consulting Group offers Qmailtoaster support and >> installations. >> If you need professional help with your setup, contact >> them today! >> >> >> --------------------------------------------------------------------------------- >> Please visit qmailtoaster.com <http://qmailtoaster.com> >> <http://qmailtoaster.com> for the >> >> latest news, updates, and packages. >> To unsubscribe, e-mail: >> [email protected] >> <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>> >> >> For additional commands, e-mail: >> [email protected] >> <mailto:[email protected]> >> <mailto:[email protected] >> <mailto:[email protected]>> >> >> >> >> >> >> >> --------------------------------------------------------------------------------- >> Qmailtoaster is sponsored by Vickers Consulting Group >> (www.vickersconsulting.com <http://www.vickersconsulting.com>) >> Vickers Consulting Group offers Qmailtoaster support and >> installations. >> If you need professional help with your setup, contact them today! >> >> >> --------------------------------------------------------------------------------- >> Please visit qmailtoaster.com <http://qmailtoaster.com> for the >> latest news, updates, and packages. >> To unsubscribe, e-mail: >> [email protected] >> <mailto:[email protected]> >> For additional commands, e-mail: >> [email protected] >> <mailto:[email protected]> >> >> >> >> > > --------------------------------------------------------------------------------- > Qmailtoaster is sponsored by Vickers Consulting Group ( > www.vickersconsulting.com) > Vickers Consulting Group offers Qmailtoaster support and installations. > If you need professional help with your setup, contact them today! > > --------------------------------------------------------------------------------- > Please visit qmailtoaster.com for the latest news, updates, and > packages. > To unsubscribe, e-mail: > [email protected] > For additional commands, e-mail: > [email protected] > > >
