how can i know the spammer

MrAdmin · #1 07-09-2005, 06:40 PM

Hi

today my server load was about 60%

I cheack Manage Mail Queue

it was about 25000 emails

how can i know which site ( account ) sent all theis emails

and how can i delet 25000 email by shell

because WHM is very slow to do that

thanks

AhmedFouad · #2 07-09-2005, 07:09 PM

You need to enable extended exim logging.

Dacsoft · #3 07-09-2005, 09:48 PM

You can remove everything in the exim queue with the command:

/usr/local/cpanel/whostmgr/bin/whostmgr2 killeximq

You might check into mailmon (http://webhosting-tools.com/view.cgi/MailMon) This script gives you more information and actually will allow you to limit the emails that are sent by sendmail.

Good luck.

MrAdmin · #4 07-10-2005, 04:10 AM

How can i prevent my server to recieve such emails

it about 100000 email

load 80%

any suggestions ?

bijo · #5 07-10-2005, 04:31 AM

Hello,

* I have taken this post from forums.cpanel.net. This post is originally posted by the GREAT JONATHAN (chirpy)
* if you have a cpanel id please have a look at this thread

http://forums.cpanel.net/showthread.php?t=39520

==========================================================A few important considerations if you haven't already done so:

1. Make sure all the /etc/valiases/domain.com are using :fail: and not :blackhole:
http://www.configserver.com/free/fail.html

2. Where possible, make sure that all the valiases domains have the catchall disabled and set to :fail:

3. Install a dictionary attack ACL:
http://www.configserver.com/free/eximdeny.html

4. Make sure that you have not set split_spool_directory to no (i.e. use the default yes)

5. Make sure you're running exim v4.50:

exim -bV

If it's not:

/scripts/updatenow
/scripts/eximup

6. Make sure that you don't have the queue processing running too frequently, i.e. leave WHM > Tweak Settings > Number of minutes between mail server queue runs > 60

7. Make sure that you have both of the following selected in WHM > Exim Configuration Editor>

Verify the existance of email senders
Discard emails for users who have exceeded their quota

8. In conjuction with sender verification, make sure that you're running bind on your server locally and that it is working and that your servers main IP address appears as the top nameserver in /etc/resolv.conf

9. Limit the length of time that you keep bounce emails in the queue by adding the following into the first texarea of the advanced exim editor:

timeout_frozen_after = 2d
ignore_bounce_errors_after = 12h

All the above can often make a huge difference to the exim load.
===========================================================
I thope it will help you to solve this problem

Let me know the status
With regards,
Bijo