Resolved Checking which site is sending spam

[Erick Nunes]

Hello, I would like to know how to find out which site from my plesk server is firing a lot of spam.

With what commands or log files do I see this?

Thank you.

 

[MarkM]

Postfix or Qmail?

 

[Erick Nunes]

Postfix or Qmail?

POSTFIX

 

[MarkM]

First thing i'd check is the number of SMTP connections per each email account;

# zgrep 'sasl_method=LOGIN' /usr/local/psa/var/log/maillog* | awk '{print $9}' | sort | uniq -c | sort -nr | head

If nothing looks out of the norm there, it's like something exploiting the PHP mail function. You can create a wrapper script which will basically add additional header information to the messages so that you can identify the source;

Many email messages are sent from PHP scripts on a server. How to find domains on which these scripts are running if Postfix is used?

You can also run the following which will show you in real time what PHP scripts are being hit;

# lsof +r 1 -p `ps axww | grep httpd | grep -v grep | awk ' { if(!str) { str=$1 } else { str=str","$1}}END{print str}'` | grep vhosts | grep php

 

[Erick Nunes]

Thank you !

Just a question, is the last command returning correct? Follow the return print

 

[MarkM]

Negative, the last time I used that was on a Plesk 10 box so it may not be accurate anymore. Sorry about that.

 

[Erick Nunes]

Thank you ! You have already helped me a lot!