0

Recently one of my boxes started to send high volume of mail which in return has spiked my load percentage on my Linux box. I have SPLUNK tied to my box which catches everything the box reads/writes. Here is one instance of a log pulled from /var/log/maillog. This type of log is constant. 5-10 messages are sent per second with different msgid's. The issue I have is unmasking the from=<>. Generally from is of the form userid@mydomain.com or authid@mydomain.com.

Nov 2 11:31:50 mx5 sm-mta[30933]: uA2GVonP030933: from=<>, size=10022, class=0, nrcpts=1, msgid=<201611021630.u9U67tNd029598@aubry.domain.com>, proto=ESMTP, daemon=MTA, relay=sendmail.domain.com [my internal IP] host = mx5 source = /var/log/maillog sourcetype = sendmail_syslog

  • mx5: mail routing server
  • msgid @aubry.domain.com is the source server
  • relay: sendmail.domain.com

I've masked my boxes to keep them confidential.

Is there a way to unmask from=<> via the message ID on the source server or via the mailQueueID uA2GVonP030933 example from log above?

0

An empty from field means no sender was specified in the envelope. This is often used for some kinds of bounces, when there was no "real" sender, but it might also be some other application.

If the server you're on did not log any further information on the delivery (or keeps the mails in his queue, make sure to look into your local delivery queues), all you can do is trying to find some information on the sending server.

  • The weird thing is the source server is using the sendmail server to send these masked emails out however since authid's are made up, my mx5 can't validate the user to send it out and therefore bouces it back. I will post the MailQueueID that shows the full path from A to Z. – Sadowgate Nov 2 '16 at 17:26
  • 11/2/16 11:32:02.000 AM Nov 2 11:32:02 mx5 sm-mta[31073]: uA2GVonP030933: to=<rebeccacampbell@mx5.domain.com>, delay=00:00:12, xdelay=00:00:12, mailer=relay, pri=40022, relay=sendmail.domain.com. [Internal IP], dsn=2.0.0, stat=Sent (uA2GVQQm004473 Message accepted for delivery) host = mx5 source = /var/log/maillog sourcetype = sendmail_syslog – Sadowgate Nov 2 '16 at 17:26
  • 11/2/16 11:31:50.000 AM Nov 2 11:31:50 mx5 sm-mta[30933]: uA2GVonP030933: from=<>, size=10022, class=0, nrcpts=1, msgid=<201611021630.u9U67tNd029598@soruceserver.domain.com>, proto=ESMTP, daemon=MTA, relay=sendmail.domain.com [Internal IP] host = mx5 source = /var/log/maillog sourcetype = sendmail_syslog – Sadowgate Nov 2 '16 at 17:27
  • 11/2/16 11:31:26.000 AM Nov 2 11:31:26 sendmail server [4333]: uA2GVDbh003811: to=<rebeccacampbell@sendmail.domain.com>, delay=00:00:10, xdelay=00:00:03, mailer=relay, pri=129754, relay=mx5.routingserver.domain.com. [Internal IP], dsn=2.0.0, stat=Sent (uA2GVonP030933 Message accepted for delivery) host = sendmail.domain.com source = /var/log/maillog sourcetype = sendmail_syslog. – Sadowgate Nov 2 '16 at 17:27
  • rebeccacampbell is a made up username – Sadowgate Nov 2 '16 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.