Re: [exim] How can I tell if my server is getting bombarded …

Top Page
Delete this message
Reply to this message
Author: Fred Viles
Date:  
To: exim-users
Subject: Re: [exim] How can I tell if my server is getting bombarded with spam?
On 14 Dec 2004 at 13:09, Tommy Butler wrote about
    "Re: [exim] How can I tell if my ser":


| Mike Oliveri wrote:
|
| >If you watch your rejectlog, you should be able to see how much mail
| >is getting rejected and at least get an idea of how much mail your
| >server is bouncing. It might just be a matter of tweaking your
| >SpamAssassin bounce threshold. You might also want to be sure you
| >don't have any relaying open (relay_from_hosts), especially for hosts
| >not under your direct control.
| >
| Well I checked it, err, am monitoring it. Virtually nothing is getting
| bounced.


The reject log shows *rejections*, meaning messages your server
refused to accept for delivery, not *bounces*, meaning new messages
being sent back to the original sender when a previously accepted
message turns out not to be deliverable.

If you are not seeing rejections in the reject log, it means you are
accepting everything you are being sent (which is a Bad Thing). My
suggestion is to shut down your mail server immediately. Then sit
down and read the Exim manual cover to cover, paying special
attention to the basic concepts of ACLs, routers, and transports.
Then go through your configuration file line by line, referring back
to the manual for details, until you understand what *everything* in
it is doing. In the process, you will learn a lot that you really
need to know and as a side effect you will see where the problems
are.

BTW, if your biggest problem is being an open relay (which is how it
sounds), fixing that should be your top priority - not spam
filtering.

- Fred