Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : is it normal?

[Lem0nHead]

root@server01 [/var/spool/exim]# du --max-depth=1
298240 ./input
151296 ./msglog
480 ./db
450028 .

seens weird... 450 MBs on /var/spool/exim

thanks

[Steven]

root@w00t [/var/spool/exim]# ls
./ ../ db/ exim-daemon.pid input/ msglog/
root@w00t [/var/spool/exim]# du --max-depth=1
392 ./input
96 ./msglog
44 ./db
540 .
root@w00t [/var/spool/exim]#

You might have a spammer, or a very large mail queue

[Lem0nHead]

Originally posted by thelinuxguy
You might have a spammer, or a very large mail queue

this thing is growing madly now

i noticed that while trying to rsync this dir with backup and it never ending

exim_mainlog shows a lot of things like

2004-05-30 02:54:41 1BUFXg-0001DP-E0 ** jimbocvzitkwnaz@sudose.com <jimbocvzItkWnaZ@sudose.com> R=fail_remote_domains: unrouteable mail domain "sudose.com"
2004-05-30 02:54:41 1BUFXg-0001DP-E0 Frozen (delivery error message)
2004-05-30 02:54:41 1BUFXZ-0006ZZ-Or Message is frozen
2004-05-30 02:54:41 1BUFXT-00080X-2E Message is frozen
2004-05-30 02:54:41 1BUFWz-0005mR-4n Unfrozen by auto-thaw
2004-05-30 02:54:41 1BUFWz-0005mR-4n ** bsmin777frjedy@luzon.tr <bsmin777FRjEDY@luzon.tr> R=fail_remote_domains: unrouteable mail domain "luzon.tr"
2004-05-30 02:54:41 1BUFWz-0005mR-4n Frozen (delivery error message)
2004-05-30 02:54:41 1BUFWt-0007vI-DT Unfrozen by auto-thaw
2004-05-30 02:54:41 1BUFWt-0007vI-DT ** pap1652cuaczszjoqfye@ipaintball.net <pap1652cuAcZszJOQfye@ipaintball.net> R=fail_remote_domains: unrouteable mail domain "ipaintball.net"
2004-05-30 02:54:41 1BUFWt-0007vI-DT Frozen (delivery error message)
2004-05-30 02:54:41 1BUFWk-0004cL-SN Unfrozen by auto-thaw

does anyone know how can I trace which user is doing that?

thanks

[Lem0nHead]

even if I STOP exim (service exim stop), those messages doesn't stop appearing!!

any ideas?

[visiondream3]

I guess this is because spamming is going on through a web script, using /usr/sbin/sendmail or /usr/sbin/exim directly and not via connect to a host ip at port 25.

[Steven]

might have a bad formmail script