How can I find the source of out going spam on a linux server?

    tail -f /var/log/exim_mainlog
2014-10-24 15:02:37 [28750] 1Xhl4A-0007Te-9C Completed QT=7s
2014-10-24 15:02:37 [28746] SMTP connection from gif2g4xf.gdp3.eu (00004e91.gdp3.eu) []:50136 I=[MY.IP]:25 closed by QUIT
2014-10-24 15:02:48 [20360] SMTP connection from []:4000 I=[MY.IP]:25 (TCP/IP connection count = 1)
2014-10-24 15:02:57 [28755] 1Xhl4S-0007Tn-IR H=static-ip-62-75-238-56.inaddr.ip-pool.com (pzqcy.veraepsilon.com) []:4000 I=[MY.IP]:25 Warning: "SpamAssassin as megraphi detected message as spam (7.7)"
2014-10-24 15:02:57 [28755] 1Xhl4S-0007Tn-IR <= burin@veraepsilon.com H=static-ip-62-75-238-56.inaddr.ip-pool.com (pzqcy.veraepsilon.com) []:4000 I=[MY.IP]:25 P=esmtp S=7205 M8S=8 id=3189815@pzqcy.veraepsilon.com T="Do not drink soda again" from <burin@veraepsilon.com> for me@me.com
2014-10-24 15:02:57 [28756] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Xhl4S-0007Tn-IR
2014-10-24 15:02:57 [28756] 1Xhl4S-0007Tn-IR => /dev/null <me@me.com> F=<burin@veraepsilon.com> R=central_filter T=**bypassed** S=0 QT=9s DT=0s
2014-10-24 15:02:57 [28756] 1Xhl4S-0007Tn-IR Completed QT=9s
2014-10-24 15:02:57 [28755] SMTP connection from static-ip-62-75-238-56.inaddr.ip-pool.com (pzqcy.veraepsilon.com) []:4000 I=[MY.IP]:25 closed by QUIT
2014-10-24 15:03:09 [20360] SMTP connection from []:24536 I=[MY.IP]:25 (TCP/IP connection count = 1)
2014-10-24 15:03:22 [28760] 1Xhl4n-0007Ts-Lk H=smtp.clayton.bluehornet.com []:24536 I=[MY.IP]:25 Warning: "SpamAssassin as megraphi detected message as NOT spam (-2.9)"
2014-10-24 15:03:22 [28760] 1Xhl4n-0007Ts-Lk <= bounce-use=M=28238984975=echo4=4DC583C1B75C5251ABA5C6D33E7A3BC8@returnpath.bluehornet.com H=smtp.clayton.bluehornet.com []:24536 I=[MY.IP]:25 P=esmtp S=12162 M8S=0 id=23.E1.41333.B0A6A445@dc4mta03 T="Order your custom daily planners today!" from <bounce-use=M=28238984975=echo4=4DC583C1B75C5251ABA5C6D33E7A3BC8@returnpath.bluehornet.com> for me@me.com
2014-10-24 15:03:22 [28772] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Xhl4n-0007Ts-Lk
2014-10-24 15:03:22 [28772] 1Xhl4n-0007Ts-Lk => my <me@me.com> F=<bounce-use=M=28238984975=echo4=4DC583C1B75C5251ABA5C6D33E7A3BC8@returnpath.bluehornet.com> P=<bounce-use=M=28238984975=echo4=4DC583C1B75C5251ABA5C6D33E7A3BC8@returnpath.bluehornet.com> R=virtual_user T=virtual_userdelivery S=12347 QT=13s DT=0s
2014-10-24 15:03:22 [28772] 1Xhl4n-0007Ts-Lk Completed QT=13s
2014-10-24 15:03:23 [20360] SMTP connection from []:59165 I=[MY.IP]:25 (TCP/IP connection count = 2)
2014-10-24 15:03:28 [28760] SMTP connection from smtp.clayton.bluehornet.com []:24536 I=[MY.IP]:25 closed by QUIT
2014-10-24 15:03:31 [28777] 1Xhl52-0007U9-Ee H=212-129-52-85.rev.poneytelecom.eu (vpu.alliedunrolls.com) []:59165 I=[MY.IP]:25 Warning: "SpamAssassin as megraphi detected message as spam (13.2)"
2014-10-24 15:03:31 [28777] 1Xhl52-0007U9-Ee <= orbit@alliedunrolls.com H=212-129-52-85.rev.poneytelecom.eu (vpu.alliedunrolls.com) []:59165 I=[MY.IP]:25 P=esmtp S=6378 M8S=8 id=9132058734131735379@vpu.alliedunrolls.com T="One day for perfect vision" from <orbit@alliedunrolls.com> for me@me.com
2014-10-24 15:03:31 [28778] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Xhl52-0007U9-Ee
2014-10-24 15:03:31 [28778] 1Xhl52-0007U9-Ee => /dev/null <me@me.com> F=<orbit@alliedunrolls.com> R=central_filter T=**bypassed** S=0 QT=7s DT=0s
2014-10-24 15:03:31 [28778] 1Xhl52-0007U9-Ee Completed QT=7s
2014-10-24 15:03:31 [28777] SMTP connection from 212-129-52-85.rev.poneytelecom.eu (vpu.alliedunrolls.com) []:59165 I=[MY.IP]:25 closed by QUIT

I have also the following added to my php.ini file

mail.add_x_header = On 
mail.log = /var/log/phpmail.log 

However, the log is empty.

I also ran

find / -type f -name "*.php*" | xargs grep -l 'mail' | xargs grep -in 'mail' > ~/mail.scripts.log 

I have added the following to Exim as well:

log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection+queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn 
  • Your log only shows incoming messages. What outgoing spam are you talking about? – Michael Hampton Oct 24 '14 at 20:18
  • The datacenter says they had a bunch of spam out going. I am trying to narrow down and find the source. But I can not seem to find a script mass sending. – Jason Oct 24 '14 at 20:22
  • One technique which may help might be to block port 25 from your server (eg using iptables -I INPUT -p tcp --dport 25 -j DROP), then installing pfqueue to view your mail queue (I assume this works with Exim - I use Postfix), and look at a queued spam message for some clues. – davidgo Oct 24 '14 at 20:50
  • You may need to ensure the /var/log/phpmail.log log is writable by the web server user (i.e., owned by apache or www and chmod 600). – Quinn Comendant Aug 3 '15 at 23:01

It depends on the distribution a little, but use netstat. I ran a telnet to connect to a Yahoo SMTP server and could then see the connection: telnet mta5.am0.yahoodns.net 25 sudo netstat -anp | grep ':25'

I then received this output, which shows telnet as opening the connection:

tcp 0 0 ESTABLISHED 31437/telnet

| improve this answer | |

It sounds like your system was sending out spam, but is not sending out spam right now (at the moment that you looked at it). You've already located your logfile to be /var/log/exim_mainlog, so the thing to do now is use a program to analyze all of your logs to see what was happening.

Exim comes with a log analysis program named eximstats. It analyzes however many files you tell it to, and outputs the results in html format. Assuming you run apache on that server, and the apache root directory is /var/www/html, I would probably make a webpage for each week's logfile (assuming your logrotate is configured to rotate them weekly) and then one big summary. This should do the trick:

mkdir /var/www/html/exim/
cd /var/log
for J in exim_mainlog*; do
  eximstats -h1 -html=/var/www/html/exim/$J.html $J
cd /var/www/html/exim/
# Now merge the weekly results into one big summary
eximstats -merge exim_mainlog*.html > summary.html

The final thing is that you make sure that Apache has +Indexes set for this directory so it will show the files in the directory instead of looking for an index.html. You may need to add a .htaccess file to set it for this directory.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.