I received a spam message to 'undisclosed recipients', and the SIMS log had
this in it, regarding this message:
17:20:03 0 SYSTEM The current date is Sunday, April 22, 2001
17:20:03 2 SMTP-010(relay1.bt.net) {S.0000088108} received, 3625 bytes
17:20:03 2 SYSTEM [S.0000088108] <00004f946ea8$00007480$000069d3@> 0+1
From:[EMAIL PROTECTED]
17:20:03 2 SYSTEM(POP) [S.0000088108] delivered to (local-account)
17:20:03 2 SYSTEM [S.0000088108] deleted
First question - Why does the log repeatedly declare the date - as in the
first line?
Second question - What does the second column represent? Status code? Error
code? Is there a list that 'decodes the codes'?
Third question - I am assuming that this log entry is telling me that this
message was received from the server 'relay1.bt.net'. If so, then how can I
configure SIMS to reject known SPAM relay servers?. Why on earth would
anyone set up a spam relay? Why would they NAME it 'relay1'!!???
Fourth question - What does the log code <00004f946ea8$00007480$000069d3@>
0+1 on the third line indicate? This is pretty indecipherable stuff.
Fifth question - How can a message be to 'undisclosed recipients' yet still
be delivered to my account? It wasn't spammed around to all accounts on my
server, just one. If the message is TO an address, how can the TO bit be
blocked, and yet the message still be deliverable???
Have been running SIMS for four years now, and it does it's job very well.
However, I am beginning to take a more active interest in what the logs are
actually telling me, and frankly - they are not telling me much!! I have
perused the 'logs' area on the stalker/sims site, but it doesn't shed much
light for me either. Any insights would be appreciated.
Cheers.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
