Topic: Is my server used for sending spam?

[Meneerik]

Hi,
I have the sme7admin contrib installed en i got an email with the message:

Tue Mar 13 20:25:11 2007 During the last 5 minutes, 267 outgoing e-mails were detected, you had set the alert limit to 5 outgoing e-mails.
(Possible reasons : do you send spam ? administrate a mailing-list ?) If you have access to the server-manager, use this link to modify the limit :

and 5 min later i got:

Tue Mar 13 20:20:10 2007 During the last 5 minutes, 149 outgoing e-mails were detected, you had set the alert limit to 5 outgoing e-mails.
(Possible reasons : do you send spam ? administrate a mailing-list ?) If you have access to the server-manager, use this link to modify the limit :

So i think my server is used to send spam email. Witch log files can i use to check this?

when i check sqpsmtp/current i can't se any date or time fields
when i check qmail/current i can't se any date or time fields

so is there something to check? is there somting to enable better mail logging? for example store all send e-mails???

Hoppe you can help me.

[bpivk]

What version of sme are you running?
Do you have all the updates?
Did you check the other computers on your LAN (for viruses and other malware)?

[CharlieBrady]

when i check sqpsmtp/current i can't se any date or time fields
when i check qmail/current i can't se any date or time fields

If you view those in the server manager every line has a timestamp.

[Curly]

To view /var/log/qpsmtpd/current use tai64nlocal like:

Code: [Select]

tail -500 /var/log/spamd/current| tai64nlocal

That gives you date-time's.

I use sme7admin also and get these warnings sometimes. I think sme7admin gets confused when logrotate rotates the logs.

edit:

Found the corresponding bug (in french !) http://bugs.contribs.org/show_bug.cgi?id=1051