Recently one of my boxes started to send high volume of mail which in return has spiked my load percentage on my Linux box. I have SPLUNK tied to my box which catches everything the box reads/writes. Here is one instance of a log pulled from
/var/log/maillog. This type of log is constant. 5-10 messages are sent per second with different msgid's. The issue I have is unmasking the
from=<>. Generally from is of the form
Nov 2 11:31:50 mx5 sm-mta: uA2GVonP030933: from=<>, size=10022, class=0, nrcpts=1, msgid=<201611021630.u9U67tNd029598@aubry.domain.com>, proto=ESMTP, daemon=MTA, relay=sendmail.domain.com [my internal IP] host = mx5 source = /var/log/maillog sourcetype = sendmail_syslog
mx5: mail routing server
firstname.lastname@example.org is the source server
I've masked my boxes to keep them confidential.
Is there a way to unmask
from=<> via the message ID on the source server or via the mailQueueID
uA2GVonP030933 example from log above?