Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Exchange 2003 server that sent me an email this morning:

SMTP Server Remote Queue Length Alert

Looking in the queues using Exchange System Manager there were just over 16,000 spam emails waiting to be sent out. We send via an external filtering service which was disconnecting our server, presumably due to the level of outgoing spam.

How can I find out where this mail is coming from? Does Exchange 2003 log IP addresses etc somewhere?

share|improve this question
add comment

2 Answers

You're probably an open relay. First thing's first is to lock down your setup. Here's some directions:
http://www.petri.co.il/preventing_exchange_2000_2003_from_relaying.htm

share|improve this answer
1  
+1 - unlikely some internal user was try ing that (even a trojan). Most likely an open relay. –  TomTom Aug 22 '10 at 22:20
add comment

Tracking down the source of outgoing spam in Exchange Server 2003 can be difficult. One thing you can try (assuming that you've got message tracking enabled) is to open one of the remote queues and look at the recipient address then track that address in the Message Tracking tool in ESM. That may allow you to find the originator of the spam. I would also recommend using the aqadmcli utility to clear out your queues.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.