There seems to be some script in the server which is executing as apache user and sending mails. Looking at ps aux output we find that sendmail executable is executed with apache user but we are not able to find specific script which is doing this.

What is the ideal way to deal with this kind of situation ?

  • First, check all your crontabs for executions of a script you don't know, maybe it's in there. Other than that it will most likely be a php exec in your /var/www-folder or wherever you put your web files into. Best ist to search for the pattern like this: grep -rnw '/var/www/' -e "mail" or grep -rnw '/var/www/' -e "exec mail" It could also be a PEAR module. Sadly only the execution is logged, not the script calling it. – Broco Aug 3 '16 at 10:45

I think you are looking for the mail.log setting in php.ini (php 5.3+ only), which will log all mail() function calls, including the script that initiated the call:

; The path to a log file that will log all mail() calls. Log entries include
; the full path of the script, line number, To address and headers.
;mail.log =
; Log mail to syslog;
;mail.log = syslog

If you are running PHP on the server, you can use below syntax to track down originating email script. Put below lines in php.ini

mail.add_x_header = On
mail.log = /var/log/phpmail.log

Above directives will add header with originating php script like below

X-PHP-Originating-Script: 456:mail.php

As well as write log in file /var/log/phpmail.log

mail() on [/var/www/html/project/tmp/mail.php:456]: To: xxx@xxxx.com -- Headers: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed; delsp=yes Content-Transfer-Encoding: 8Bit X-Mailer:  Sender: xxx@xxxx.com From: xxx@xxxx.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.