0

I have an Exim server with several domains configured. In each domain I have several email accounts. From time to time a computer configured with one of this emails gets infected and starts sending spam.

I use to have Isoqlog to get reports of the top sendin email accounts, but it does not work any mor since it was las updated in 2005.

I need a way to find out the top 50 spamming email accounts in the last 24 hs (not the sender, the account that is being used to authenticate to send spam. The sender can be fake so is no valid data)

Any idea if there is a package (like Isoqlog or similar)that can do this? Thanks

0

You don't need a complex program to extract information from the log file. An Exim4 log line for incoming mail looks like this:

2020-01-18 02:19:41 1iscm4-0000Nt-TE <= env_sender@example.com\
H=verified_rdns.example.net (helo.example) [192.0.2.1] P=esmtpsa\
X=TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128 CV=no A=dovecot_gssapi:auth_user\
S=3812 id=1d9f3556-251c-734c-9b96-68ce1e52839c@example.com

with the envelope sender env_sender@example.com, the sending host H=verified_rdns.example.net (helo.example) [192.0.2.1] and a list of tag=value.

We are mostly interested in the A tag which has a value of the form authenticator:auth_user, where authenticator is the name of the Exim4 authenticator you gave in the config file and auth_user is the authenticated user.

Putting everything together, we can print the count of e-mails sent by each user in the time spanned by the log file using a simple bash script:

#!/bin/bash 
if [ $# -lt 1 ]; then
    2>& echo Usage: $0 "<exim_mainlog_file>"
    2>& echo Example: $0 /var/log/exim4/mainlog
    exit 1
fi
# To save typing
d='[[:digit:]]'
a='[[:alnum:]]';
pref="^$d\{4\}-$d\{2\}-$d\{2\} $d\{2\}:$d\{2\}:$d\{2\} $a\{6\}-$a\{6\}-$a\{2\}"
logfile="$1"

zgrep "$pref <=" "$logfile" |
grep -oh "A=[[:alnum:]_]\+:[[:alnum:]_]\+" |
cut -d : -f 2 |
sort |
uniq -c |
sort -rn
| improve this answer | |
  • I have try your script with no success. What would be the command syntax of it to work? can you give an example? – FedeKrum Jan 18 at 22:31
  • If it is called eximlog.sh use it as ./eximlog.sh /var/log/exim4/mainlog or any other Exim4 mainlog. I modified the script to print usage when called without parameters. – Piotr P. Karwasz Jan 18 at 23:07
  • It still does not work. Can it be the format of the logs? any chance I can give you a log to test it? – FedeKrum Jan 19 at 18:39
  • Yes, the format might change or the names of the authenticators. Add a couple of log lines to match to your question. – Piotr P. Karwasz Jan 19 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.