Topic: Checking Outgoing Email

[Bozely]

Hi i'm reasonably new to SME and am trying to see what outgoing emails have been sent, we have had a few SME Admin warnings where too many emails have gone out than what i consider reasonable and i'm concerned someone has a mailing virus.

What are some of the best ways to get this information?

Any help is greatly appreciated.

[mmccarn]

You can see some email statistics from the server-manager::Administration::mail log file analysis.  You may be able to see what you're looking for using the 'sender statistics' or 'recipient statistics' reports.

Any email sent by a local client through your SME would have to be handled by qpsmtpd.  You can find out what emails are accepted for delivery or relay by qpsmtpd by enabling 'qplogsumm.pl' as described in http://wiki.contribs.org/Email_Statistics#Server-Manager.  You'll then get updated email statistics whenever your qpsmtpd logs rotate in the file /var/log/qpsmtpd/state.  Once qplogsumm.pl has created some statistics you can view them with server-manager::Administration::View log files (then pick qpsmtpd/state).

If your SME server itself has been compromised you may need to see what qmail is up to (once qpsmtpd accepts a message for processing, qmail is used to actually deliver it to a remote system).  You can create graphs of qmail activity using http://wiki.contribs.org/Qmail_Statistics_%28AWStats%29

Lots of server info (including email traffic counts) can be obtained using http://wiki.contribs.org/Sme7admin.  (Be careful - sme7admin uses rrdtool, which has some version conflicts between different contribs...)

(note: AWStats link fixed per note from mweinber below)

[m]

In addition to the graphs, AWStats Qmail Statistics also provides lists of recent sender and recipient addresses.

@mmccarn: In your last post the link to the AWstats Howto is broken

[Bozely]

Thanks for the response,

that all makes perfect sense, my problem now is that this happens perhaps once a week on a Saturday and my log files only stretch back the best part of an hour and a half!

Where can I adjust the time limit before it deletes the log file, I understand not wanting to amass a huge backlog of files but to give me a chance at analysing the information i would need to temporarily keep log files for at least a couple of days.

[mmccarn]

Here's a post describing how to increase your qpsmtpd log retention: http://forums.contribs.org/index.php?topic=32853.0

Be aware that the log retention will revert to the default the next time you upgrade your server...

[holck]

I run the ezmlm mailing list manager, and this works fine, except that a lot of spam is sent to the mailing lists, e.g. to list-subscribe@mydomain.com and list-unsubscribe@mydomain.com. Therefore I would like to monitor what mails are actually sent from ezmlm, including service messages. But I cannot find these messages logged anywhere.

Do you know if I can get messages from ezmlm logged - and how?

Thank you,
Jesper

--- Sorry, just found the answer myself: the messages are logged in /var/log/qmail/current