Running debian testing(wheezy) on a virtual host as a web server/mysql server.
It's got logwatch installed, and occasionally I'm getting a mail bounce to an invalid address.
It's inconsistent in timing, and is directed to email@example.com which is invalid. (its hosted on gmail apps, and now occurs to me I can add that email to find what its sending, but question remains if that's not an option).
I check the exim logs and it has no additional information beyond what's in logwatch.
2012-09-18 06:27:38 ** firstname.lastname@example.org R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<email@example.com>: host ASPMX.L.GOOGLE.com [18.104.22.168]: 550-5.1.1 The email account that you tried to reach does not exist. Please try\n550-5.1.1 double-checking the recipient's email address
So any ideas to figure out what script could be sending this mail? Exim configuration maybe for more debug? It isn't putting out any logs but mainlog, no error or panic.
I've tried grepping on config files looking for that email address, but no luck.
Edit: its not the logwatch message itself, that part works fine. Its the content of that message that references the bad email bounce. (ie, logwatch is correctly reporting the eximlog)