Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I manage a small VPS and have noticed in the last few days that email usage has blown way out of the norm. What usually is only a few dozen has instantly shot up to our relay-limit of 1,000/day. The OS is CentOS and I'm running Simple Control Panel to assist me in setting up email addresses and domains.

How can I determine which account, on which domain, is sending/receiving all of these emails?

enter image description here

Resolving the issue:

As suggested in the accepted answer below, I ran the mailq command and was immediately flooded with a seemingly never-ending list of email addresses. Finally forcing the load to abort with CTRL+Z, I was able to discern which account all of the email addresses were coming from:

004F1C3D5B0* 22534 Fri Feb 11 12:27:48

This is an extremely small sample of what filled my screen. From this, I was able to determine that the lowercase email on the first line must be the address sending/receiving all of these emails.

I hope I'm not mistaken.

share|improve this question
up vote 2 down vote accepted

Check you email log. For Exim it may be /var/log/exim4/mainlog. For other mailers it may be /var/log/mail. There should be a couple of entries for each email showing who sent it and who it was sent to. If it was sent to multiple recipients there may be multiple entries per user. The mailq command may show what is queued which may help.

share|improve this answer
Within /var/log/ I have httpd, mailman, samba and turbopanel. Plus several .gz files of the format maillog.x.gz where x is a sequential number 1, 2, 3, etc. – Sampson Feb 14 '11 at 19:58
Running the mailq command seems to have showed exactly who might be the culprit. Thanks! – Sampson Feb 14 '11 at 20:04
@Jonathan: if that helped you out, you should accept it as an answer. – Olli Feb 14 '11 at 20:05
@Olli I was away working to solve the current crisis - with a 100% acceptance rating here I can assure you that I will not forget those who have assisted me in resolving this issue :) – Sampson Feb 14 '11 at 20:29

If you're running Exim, the eximstats program will take an exim mainlog file and spit out all manner of stats on sending hosts, destination hosts, sending users, destination mailboxes etc.

I assume similar programs exist for other MTAs, but I've been fortunate enough to always have the choice, and always chosen Exim.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.