Re: [exim] re spamming

Chris Lear wrote:
> > There are many cases where the SMTP connection uses a non-trivial
> > amount of bandwidth, but no logs to this effect are produced. The
> > same goes for most other services.
>
> The size might not be logged, but the fact that something happened would
> be logged, wouldn't it? My understanding (well, my guess anyway) was

Something would be logged. Whether it's seen in a grep of the logs
is another thing altogether.

This session

[laptoy] /usr/home/ianf $ telnet localhost 25
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 hetzner.co.za ESMTP Exim 4.63 Wed, 22 Nov 2006 14:51:26 +0200
HELO localhost
250 hetzner.co.za Hello localhost [127.0.0.1]
MAIL FROM:<if@???>
250 OK
RCPT TO:<if@???>
250 Accepted
DATA
354 Enter message, ending with "." on a line by itself
Subject: Test

aoeeaoeaoe
aoea
oeao
ea
oeao
ea
oeaoeaeaeaeauoioed.puixaeiaeuioeioeai
aoeuaoeuaoeuaoiaeuieaiue
^]
telnet> quit
Connection closed.

Produces the following log:

2006-11-22 14:52:32 SMTP connection from localhost [127.0.0.1] lost while reading message data

Which might or might not have been seen the OP. He didn't really
say what was in the logs. He didn't say whether it was to or from
the server in question. It could have been another process. There
might be mails in the queue that are timing out during data to the
remote end. It could have been anything. I guess I'm just a bit
jaded from having worked on this particular problem for too many
years. Quality debugging will reveal all.

Ian

--
Ian Freislich