0

We have sendmail set up as a SMTP relay on a RHEL 6 machine.

How can we find the hostname or IP address of remote clients using this relay to send mail? Is this information logged somewhere?

The relay= field in /var/log/maillog specifies the hostname who accepted or rejected the mail recipient, which is not what we need.

2
  • how have you configured sendmail's logging? Oct 5, 2023 at 13:59
  • 1
    AFAIK it's the default logging configuration: mail.* -/var/log/maillog in /etc/rsyslog.conf.
    – dr_
    Oct 5, 2023 at 14:18

1 Answer 1

2

There should be at least two lines logged in /var/log/maillog for each relayed message, identifiable by the matching Message-ID. The first one should record where the message was received from; the second documents where it was relayed to.

If your sendmail is configured with anti-malware and/or anti-spam checkers, there might be more lines for each processed message.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .