tracking outgoing mail

[avifra]

i must be able to log all smtp activity, need to know who sent what to who and when. Then if someone tell me i sent this mail to this person that day i can check it in the log file
i know that qmail keep info in /usr/local/psa/var/log/maillog and smtp access are logged in /var/log/secure but those are not much detailled and, about smtp, tell too few...
any help on this would be highly appreciated...

(my server run FC4, Plesk 8.0.1 and i installed clamav, clamd and qmail-scanner, awstats)

 

[ipkiss_]

I'm pretty new to Plesk, but normally you can setup qmail to log whatever you want using e.g. multilog (http://cr.yp.to/daemontools/multilog.html) OR you can make a copy of every e-mail using this patch:
http://inter7.com/?page=qmailtap

 

[avifra]

tracking outgoing mail (log files)

Thanks for your reply ipkiss, well in fact the problem is that not ALL outgoing mails are logged into the files. If i use horde it's ok but if i use a client like outlook for externals addresses it doesn't appear on the logs
I guess i should change something and create a supervise folder in the qmail hierarchy. still trying to figure out...

 

[jamesyeeoc]

Have you tried qmail-scanner from atomicrocketturtle.com ? It does give more details about incoming and outgoing emails, including IPs and from/to, etc. It scans incoming and outgoing emails. Coordinates your AntiVirus, Qmail, Spamassassin. All around good stuff.

The qmailtap posted above AFAIR, would require you to download Qmail sources, Plesk patches, and recompile Qmail from scratch on your server. This can be done, but depends on your admin level of skills...

 

[avifra]

qmailtap

yes james, i installed qmail-scanner, clamav and clamd. i have many information in my /var/spool/qscan/qmail-queue.log but i made a try, i sent via outlook a mail to my yahoo address and it didn't show in the log files.
I guess some mails are not scanned but couldn't figure out why so far...
i have to say i'm not a great fan of plesk. Don't understand why, behind their nice interface there is such lack of logs informations...

 

[jamesyeeoc]

You didn't list it, but I assume you also have Spamassassin installed...

You are sure your Outlook is not set to use your local DSL provider for outgoing SMTP (just have to ask) due to port 25 blocking/filtering??

In the /var/spool/qmailscan/qmail-queue.log you should have entries such as:

Fri, 28 Jul 2006 02:50:39 PDT:353: +++ starting debugging for process 353 (ppid=349) by uid=2020
Fri, 28 Jul 2006 02:50:39 PDT:353: w_c: elapsed time from start 0.003779 secs
Fri, 28 Jul 2006 02:50:39 PDT:353: return-path='[email protected]', recips='[email protected]'
Fri, 28 Jul 2006 02:50:39 PDT:353: from='<[email protected]>', subj='test qmail-scanner logging to Yahoo', via SMTP from my.ip.add.ress
Fri, 28 Jul 2006 02:50:39 PDT:353: clamdscan: finished scan in 0.029867 secs
Fri, 28 Jul 2006 02:50:39 PDT:353: fprot: finished scan in 0.249131 secs
Fri, 28 Jul 2006 02:50:41 PDT:353: SA: finished scan in 1.488111 secs - hits=0.3/6.0
Fri, 28 Jul 2006 02:50:41 PDT:353: p_s: finished scan in 0.015418 secs
Fri, 28 Jul 2006 02:50:41 PDT:353: ini_sc: finished scan of "/var/spool/qmailscan/tmp/mydomain.net1154080239722353"...
Fri, 28 Jul 2006 02:50:41 PDT:353: ------ Process 353 finished. Total of 1.815174 secs

I just now sent an email to my Yahoo account to grab this from the qmail-scanner log. Same thing when I send to my accounts at HotMail, Gmail, AOL, etc. Standard install of ART's qmail-scanner, no debug mode or anything. However, I'm not currently upgraded to his 2.xx version.

 

[jwdick]

I do this as a quick check of all outgoing emails:

create a script called sentmail with the following line:

cat -n /usr/local/psa/var/log/maillog | grep "to remote" | less


it produces an output like this:
2323 Jul 28 08:29:41 ip-xx-xx-xx-xx qmail: 1154093381.312266 starting delivery 876: msg 211249561 to remote email@address

If I need to check the email further, I use:

cat /usr/local/psa/var/log/maillog | grep "qmail number" | less

where "qmail number" in this case is 1154093391 to match output of the sentmail script.

This gives me all of the information about the outgoing email.

 

[DCNet_James]

Re: tracking outgoing mail (log files)

Originally posted by avifra
Thanks for your reply ipkiss, well in fact the problem is that not ALL outgoing mails are logged into the files. If i use horde it's ok but if i use a client like outlook for externals addresses it doesn't appear on the logs
I guess i should change something and create a supervise folder in the qmail hierarchy. still trying to figure out...

I know this is a stupid question, but using your client, do you have the SMTP server set to use your PSA server and not some other SMTP server. Some people say for instance you're on Comcast cable and are required to use their SMTP server because they block all other outgoing SMTP traffic. Like I said I know its a stupid question, but I've seen more people make this mistake than not. If Horde is logging SMTP conversations, theres no reason that remote clients shouldn't, they all talk to the same daemon.

J

 

[avifra]

Well, obviously i use the PSA server as SMTP, i tried using the fqdn mail server name nor the ip address in my outlook setup but got same result. You are quite right it's not normal than using the horde interface mails sent appear in the log and via outlook they don't... So far i couldn't fix it