mail queue loading up, how can I tell from who>?

[GlobalDC]

Hello, I am having problem with one domain on my server spamming, however, I cannot track who is doing it.

The mail queue is loading up, and server load shoots up to over 100 when the spam starts flowing.

How can I tell who is doing it?/What account it's coming from?



Any help or ides would be greatful.

Thanks,
Chris

[jmstacey]

Try looking through the exim log

/var/log/exim/exim_mainlog

[nobaloney]

It's doubtful that anyone on the server is spamming, though of course it's possible.

More likely your queue is packed with email sent by spammers that the box is trying to return as undeliverable, but the return addresses are undeliverable as well.

This happens because the exim.conf file as originally delivered by DA accepts email for users even if they don't have addresses on the server.

Use the SpamBlocker exim.conf file; it doesn't let exim accept email for nonexistent users.

If you don't want to use SpamBlocker, that's okay, just don't put any domains into the /etc/virtual/usr_rbl_blocklists file.

Jeff