Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know how to detect if qmail has been hijacked

I looked and saw a bunch of

Dec 23 14:10:57 qmail: 1261606257.101924 starting delivery 36: msg 8423008 to remote Dec 23 14:10:57 qmail: 1261606257.630379 starting delivery 22: msg 8421857 to remote

load is at 20 think spammer is sending mail through the server?

What can I do to try and stop it, or read the mail to see where its coming from? If its a php form or pop account.

share|improve this question
What kind of logging is available? SMTP logging? MTA logging? Have you run the equivalant of netstat to look at current network connections? – joeqwerty Dec 24 '09 at 0:16


or better


will be the starting point.

Then locate a SPAM message ID and search for a file with that name in /var/qmail/queue (find /var/qmail/queue -iname ).

Find common characteristic to all SPAM (say IP/Subject, From, Auth information etc.) and use qmHandle to remove emails from queue and take steps to make sure that SPAM stop coming.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.