Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: Meneerik on March 13, 2007, 11:52:32 PM

Title: Is my server used for sending spam?
Post by: Meneerik on March 13, 2007, 11:52:32 PM

Hi,
I have the sme7admin contrib installed en i got an email with the message:

Quote

Tue Mar 13 20:25:11 2007 During the last 5 minutes, 267 outgoing e-mails were detected, you had set the alert limit to 5 outgoing e-mails.
(Possible reasons : do you send spam ? administrate a mailing-list ?) If you have access to the server-manager, use this link to modify the limit :

and 5 min later i got:

Quote

Tue Mar 13 20:20:10 2007 During the last 5 minutes, 149 outgoing e-mails were detected, you had set the alert limit to 5 outgoing e-mails.
(Possible reasons : do you send spam ? administrate a mailing-list ?) If you have access to the server-manager, use this link to modify the limit :

So i think my server is used to send spam email. Witch log files can i use to check this?

when i check sqpsmtp/current i can't se any date or time fields
when i check qmail/current i can't se any date or time fields

so is there something to check? is there somting to enable better mail logging? for example store all send e-mails???

Hoppe you can help me.

Title: Is my server used for sending spam?
Post by: bpivk on March 14, 2007, 12:00:03 AM

What version of sme are you running?
Do you have all the updates?
Did you check the other computers on your LAN (for viruses and other malware)?

Title: Re: Is my server used for sending spam?
Post by: CharlieBrady on March 14, 2007, 12:34:52 AM

Quote from: "Meneerik"

when i check sqpsmtp/current i can't se any date or time fields
when i check qmail/current i can't se any date or time fields

If you view those in the server manager every line has a timestamp.

Title: Is my server used for sending spam?
Post by: Curly on March 14, 2007, 08:24:33 PM

To view /var/log/qpsmtpd/current use tai64nlocal like:

Code: [Select]

tail -500 /var/log/spamd/current| tai64nlocal

That gives you date-time's.

I use sme7admin also and get these warnings sometimes. I think sme7admin gets confused when logrotate rotates the logs.

edit:

Found the corresponding bug (in french !) http://bugs.contribs.org/show_bug.cgi?id=1051