Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just started up a new instance that i build using debian squeeze on amazon last night. This morning I just got an email saying that I reached a limit on the volume of email you were able to send out of SMTP port 25 on your instance

I'm not sys admin min by any means but I'm relatively comfortable using linux, but I've never had this problem before. I tried searching for some mta's installed that i know of, postfix, exim etc.. and saw nothing, so I think in need to go a bit lower level and just monitor port 25 to see what's happening.

Can someone enlighten me as to some tools I can use to find out what mail activity is going on on my server? And maybe some tips on tightening things up, I don't use a mail server at all, i really only run webapps.

Many thanks.

share|improve this question
add comment

4 Answers

Who needs a fancy monitor when log files do? :-) Have you read the log (probably something like /var/log/mail.log)? From there you can see if there was recently some abnormal SMTP activity.

If you want to monitor the network traffic itself, then tcpdump or wireshark are good choices.

share|improve this answer
    
interesting... /var/log/mail.log is empty... also the mail.err .warn and .info are empty too... –  brad Nov 9 '10 at 13:32
    
Did you read the other logs? It all depends on syslog settings where mail gets logged. –  Janne Pikkarainen Nov 9 '10 at 13:36
    
If the logs are empty it probably is going to be a script, not the mail server. If you don't need the mail server you could try turning it off. You could also add a iptables rule to block outbound port 25 if you don't need it. –  mfarver Nov 9 '10 at 16:22
    
try looking in /var/log/maillog ? It's usually stored somewhere in /var/log/mail ish area. –  AliGibbs Nov 9 '10 at 17:24
add comment

Can I suggest that before you do anything else you stop that MTA.

If you've received a "You've sent too much mail" warning, and as far as you're concerned you haven't sent any, then one of two things is happening, Amazon are logging incorrectly, or you have an open relay, and my money is on the latter more than the former.

share|improve this answer
    
i couldn't find any mta at all when i was looking at packages... I'm just using a clean install of debian squeeze, the only thing I installed was nginx –  brad Nov 9 '10 at 20:27
add comment

iptraf will also let you monitor live traffic

apt-get install iptraf

However I agree with the previous posts - and you would be smart to check the system logs first.

Have you also checked to verify your mail server is not an open Relay? Might be best to do so...

There are free tools to do this - http://www.checkor.com/ is one. If it is an open relay than the problem most likely is that the system needs to be locked down.

If it is not - than you may have a script doing something it should not...

Check that first - and then let us know - the community is here to help

share|improve this answer
    
Thanks for the info, checkor said connection refused, i also did a port scan and only 80 was open. iptraf only showed my ssh connection.I have a feeling this was just an error from Amazon. I DID log a debian bug through reportbug and it sends an email, i wonder if this has anything to do with it? –  brad Nov 10 '10 at 0:46
    
Also, I'm just using the default amazon security group which I think only allows 80 and 22 externally, so I think i'm safe. But thanks again, it was certainly an unnerving email. –  brad Nov 10 '10 at 0:47
add comment

I think the easiest way to get a quick look at exactly what's happening would be to utilize IPTables. How about something like:

iptables -A INPUT -p tcp -s <your_ip_range/x> --dport 25 -j LOG --log-level debug
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.