In maillog i see this

[dreamfox]

Apr 30 21:27:13 damian spamd[24767]: spamd: connection from localhost [127.0.0.1] at port 56844
Apr 30 21:27:13 damian spamd[24767]: spamd: setuid to dhnl succeeded
Apr 30 21:27:13 damian spamd[24767]: spamd: processing message <PpKQoClLZ0003d61d@bay0-mc1-f2.bay0.hotmail.com> for dhnl:1010
Apr 30 21:27:14 damian spamd[22648]: spamd: clean message (3.0/5.0) for dhnl:1010 in 2.1 seconds, 5283 bytes.
Apr 30 21:27:14 damian spamd[22648]: spamd: result: . 3 - AWL,BAYES_00,FORGED_HOTMAIL_RCVD,HTML_IMAGE_ONLY_28,HTML_MESSAGE,NO_REAL_NAME sc
Apr 30 21:27:14 damian spamd[1393]: prefork: child states: IB
Apr 30 21:27:14 damian spamd[22648]: spamd: connection from localhost [127.0.0.1] at port 56892
Apr 30 21:27:14 damian spamd[22648]: spamd: setuid to dhnl succeeded
Apr 30 21:27:14 damian spamd[22648]: spamd: processing message <qjovoP6en000344c2@bay0-mc10-f22.bay0.hotmail.com> for dhnl:1010
Apr 30 21:27:15 damian spamd[24767]: spamd: clean message (3.0/5.0) for dhnl:1010 in 2.1 seconds, 5266 bytes.
Apr 30 21:27:15 damian spamd[24767]: spamd: result: . 3 - AWL,BAYES_00,FORGED_HOTMAIL_RCVD,HTML_IMAGE_ONLY_28,HTML_MESSAGE,NO_REAL_NAME sc
Apr 30 21:27:15 damian spamd[1393]: prefork: child states: BI
Apr 30 21:27:16 damian spamd[22648]: spamd: clean message (3.0/5.0) for dhnl:1010 in 2.2 seconds, 5286 bytes.
Apr 30 21:27:16 damian spamd[22648]: spamd: result: . 3 - AWL,BAYES_00,FORGED_HOTMAIL_RCVD,HTML_IMAGE_ONLY_28,HTML_MESSAGE,NO_REAL_NAME sc
Apr 30 21:27:16 damian spamd[1393]: prefork: child states: II
Apr 30 21:27:17 damian spamd[22648]: spamd: connection from localhost [127.0.0.1] at port 57017
Apr 30 21:27:17 damian spamd[22648]: spamd: setuid to dhnl succeeded


Is this something to worry about?

[floyd]

What in there makes you think there is something to worry about?

[dreamfox]

i thought maybe is someone using my server to send spam?
i see strange ports and stuff
But i'm not a sysadmin ;-)
that's why i put up the question

[floyd]

What you see is spamd doing its job.

The strange ports you see are from your own server (localhost) connecting to spamd.