Help with exim_mainlog

Posted on 2010-09-13
Last Modified: 2013-11-30
Someone is sending a ton of spam out from my server but I can't figure out who the sender is. I attached a few lines from my log. The sender appears to be 1Ounp6-0008So-0z, is that some sort of ID created by exim?

Thank you

2010-09-13 09:15:01 1Ounp6-0008So-0z => R=send_to_smart_host T=remote_smtp H=k2smtpout-                                     []*
2010-09-13 09:15:01 1Ounp6-0008So-0z -> R=send_to_smart_host T=remote_smtp H=k2smtpout-                                     []*
2010-09-13 09:15:01 1Ounp6-0008So-0z -> R=send_to_smart_host T=remote_smtp H=k2smtpout                                     []*

Open in new window

Question by:itsofmi
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 45

Expert Comment

by:Kent Olsen
ID: 33662366
Hi itsofmi,

You probably have SMTP relay enabled.  Some spammer is just routing his mail through you to mask his true identity.

LVL 26

Expert Comment

ID: 33663172
1Ounp6-0008So-0z is the message id...

Author Comment

ID: 33663267
is there any way to see the sender in the mainlog?
Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

LVL 26

Expert Comment

ID: 33663708
Not sure (I'm a Sendmail guy), but this command should show you queued messages with the sender and recipient addresses:

# exim -bp

So if you still have spam queued up, you can see the sender address
LVL 45

Accepted Solution

Kent Olsen earned 250 total points
ID: 33664406
You should be able to look at the network packets and examine in incoming IP addresses.  If you're acting as an SMTP relay there should be a lot of connections from a single address.
LVL 26

Assisted Solution

jar3817 earned 250 total points
ID: 33664427

# netstat -an |grep :25

That'll show you active connections on port 25.

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As tax season makes its return, so does the increase in cyber crime and tax refund phishing that comes with it
In the first part of this tutorial we will cover the prerequisites for installing SQL Server vNext on Linux.
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question