How can I find out which application is sending emails?
On the server I have qmail. I would like to check if there is some kind of script or application that sends emails (something like spam application). Is it possible to find out that?
qmail denotes the numeric user id of the system account in the headers. Look for a header in this form:
Received: (qmail 24531 invoked by uid 533); 26 Aug 2010 21:08:19 -0000
In this example you can quickly see that user 533 has produced this mail. In a web hosting environment with cleanly separated users this should help much.
However, qmail can't tell you which application created the mail in question (in fact, the mail may have reached qmail through a pipe to /var/qmail/bin/qmail-inject
or /usr/sbin/sendmail
so that qmail has no way of knowing who is producing the mail.
If you're facing a spammer, it would be a good idea to check your access_log
: Look for timestamps that are identical with the timestamps of the mail in question.
Check if it is caused by a rootkit download and run rootkit_hunter: http://www.rootkit.nl/projects/rootkit_hunter.html