{"id":187,"date":"2018-01-26T13:00:50","date_gmt":"2018-01-26T13:00:50","guid":{"rendered":"http:\/\/linuxresellerwebhosting.in\/blog\/?p=187"},"modified":"2018-02-08T18:57:31","modified_gmt":"2018-02-08T18:57:31","slug":"useful-commands-find-spam-mails-exim-mail-servers","status":"publish","type":"post","link":"https:\/\/linuxresellerwebhosting.in\/blog\/useful-commands-find-spam-mails-exim-mail-servers\/","title":{"rendered":"Useful Commands to Find Spam Mails for Exim Mail Servers"},"content":{"rendered":"<p>Hi all !<\/p>\n<p>In this article, We are going to see how to find out Spam mails generating from Exim Mail Servers. Controlling Spam mails is a challenge task for every server administrator. Let&#8217;s find out how to locate the Spam generating script and stop it.<\/p>\n<p>What is Spam mail ?<\/p>\n<p>Spam is the use of electronic messaging systems to send unsolicited bulk messages, especially advertising, indiscriminately.<\/p>\n<p>Why do we stop Spam mail ?<\/p>\n<p>Due to more number of Spam mails, Server&#8217;s IP address reputation will get poor and this will lead to list the IP in Spam database.<\/p>\n<p>How can we stop spam mail ?<\/p>\n<p>First we have to locate the infected scripts on the server using the mail server logs.<\/p>\n<p>Exim Mail Log :<\/p>\n<p>Exim mail server maintain three mails logs that are mentioned on below.<\/p>\n<pre class=\"lang:default decode:true\">\/var\/log\/exim_mainlog\r\n\/var\/log\/exim_paniclog\r\n\/var\/log\/exim_rejectlog<\/pre>\n<p>Exim_mainlog :<\/p>\n<p>This logs tracks every single mail transaction that your server handles. This is the go-to log when troubleshooting all e-mail delivery problems.<\/p>\n<p>Exim_rejectlog :<\/p>\n<p>This log only logs delivery rejections. While this can be useful, this is not the first log file you will want to search when troubleshooting a mail problem. For example, if mail is getting through on the server, but your mail client is silently failing to download mail, this log will not help you.<\/p>\n<p>Exim_paniclog :<\/p>\n<p>This log contains has information regarding the exim program itself, and not mail transactions. For this reason, it is not suitable for most mail troubleshooting.<\/p>\n<p>Steps to locate the script that generating Spam mails :<\/p>\n<ul>\n<li>Login to the server via SSH using putty.<\/li>\n<li>Once logged into the server, execute the below command to locate Spam generating script.<\/li>\n<\/ul>\n<pre class=\"font-size:11 lang:default decode:true\">grep cwd \/var\/log\/exim_mainlog | grep -v \/var\/spool | awk -F\"cwd=\" '{print $2}' | awk '{print $1}'\r\n|sort | uniq -c | sort -n<\/pre>\n<ul>\n<li>Let&#8217;s breakdown the command step by step<\/li>\n<\/ul>\n<p>grep cwd \/var\/log\/exim_mainlog &#8211;&gt;\u00a0Use the <strong>grep<\/strong> command to locate mentions of <strong>cwd<\/strong> from the Exim mail log. This stands for <strong>current working directory<\/strong>.<\/p>\n<p>grep -v \/var\/spool&#8211;&gt; Use the <strong>grep<\/strong> with the <strong>-v<\/strong> flag which is an invert match, so we don&#8217;t show any lines that start with <strong>\/var\/spool<\/strong> as these are normal Exim deliveries not sent in from a script.<\/p>\n<p>awk -F&#8221;cwd=&#8221; &#8216;{print $2}&#8217; | awk &#8216;{print $1}&#8217; &#8211;&gt; Use the <strong>awk<\/strong> command with the <strong>-F<\/strong>ield seperator set to <strong>cwd=<\/strong>, then just print out the <strong>$2<\/strong>nd set of data, finally pipe that to the <strong>awk<\/strong> command again only printing out the <strong>$1<\/strong>st column so that we only get back the script path.<\/p>\n<p>sort | uniq -c | sort -n &#8211;&gt; Sort the script paths by their name, uniquely count them, then sort them again numerically from lowest to highest.<\/p>\n<p>Once you executed the command, you will get output like this<\/p>\n<pre class=\"lang:default decode:true \">25 \/home\/userna5\/public_html\/Spam_generating_Path\r\n36 \/home\/userna5\/public_html\/Spam_generating_Path\r\n10276 \/home\/userna5\/public_html\/Spam_generating_Path<\/pre>\n<p>From which you can identify the script that sending more number of Spam mails.<\/p>\n<p>Once you located the script, you can Investigate it further by contacting developer to take appropriate actions \ud83d\ude42<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi all ! In this article, We are going to see how to find out Spam mails generating from Exim<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[1],"tags":[],"class_list":["post-187","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/posts\/187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/comments?post=187"}],"version-history":[{"count":15,"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/posts\/187\/revisions"}],"predecessor-version":[{"id":206,"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/posts\/187\/revisions\/206"}],"wp:attachment":[{"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/media?parent=187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/categories?post=187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxresellerwebhosting.in\/blog\/wp-json\/wp\/v2\/tags?post=187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}