Re: [exim] Localhost spam mails?

Top Page
Delete this message
Reply to this message
Author: W B Hacker
Date:  
To: exim users
Subject: Re: [exim] Localhost spam mails?
petepo wrote:

> Hi Guys,
>
> I am seeing this particular message on exim log, seems it is sending as
> localhost? Anyway to kill off this message. It is occuring every few
> minutes.. Thanks.
>
> [root@SA2 bin]# cat /var/log/exim_mainlog | grep 1GUn5x-0005py-M3
> 2006-10-04 00:26:13 1GUn5x-0005py-M3 SA: Debug: SAEximRunCond expand
> returned: '1'
> 2006-10-04 00:26:13 1GUn5x-0005py-M3 SA: Debug: check succeeded, running
> spamc
> 2006-10-04 00:26:17 1GUn5x-0005py-M3 SA: Action: scanned but message isn't
> spam: score=2.0 required=5.0 (scanned in 4/4 secs | Message-Id:
> E1GUn5x-0005py-M3@???). From <> (local) for aika@???
>
> 2006-10-04 00:26:17 1GUn5x-0005py-M3 <= <> R=1GUm6Y-00057U-Co U=exim P=local
> S=6986
> 2006-10-04 00:26:17 1GUn5x-0005py-M3 == aika@??? R=dnslookup
> T=remote_smtp defer (-53): retry time not reached for any host
> 2006-10-04 01:29:17 1GUn5x-0005py-M3 == aika@??? R=dnslookup
> T=remote_smtp defer (-53): retry time not reached for any host
> 2006-10-04 02:31:21 1GUn5x-0005py-M3 == aika@??? R=dnslookup
> T=remote_smtp defer (-53): retry time not reached for any host
> 2006-10-04 03:27:17 1GUn5x-0005py-M3 == aika@??? R=dnslookup
> T=remote_smtp defer (-53): retry time not reached for any host
> 2006-10-04 04:26:17 1GUn5x-0005py-M3 == aika@??? R=dnslookup
> T=remote_smtp defer (-53): retry time not reached for any host



Killing the message is easy:

exim -Mrm 1GUn5x-0005py-M3

You might want to first look at it - body and/or headers:

ls -lF /var/spool/exim

or wherever you have it...

less <path and filename>

Then - as SAExim looks like a pre-Exiscan version of Exim. What does:

exim -bV

return to you?


And what *else* is on that box? An httpd with PHP/perl/cgi/<whatever> formail
maybe?


Bill