topic Re: FIND in Operating System - HP-UX

FIND

Hunki — Thu, 16 Mar 2006 17:16:12 GMT

I have this mail from a develop asking me to remove him from the distribution list, but I cannot find the script which generated the mail.I looked in cron , no luck , i grepped also in different dirs , no luck. Is there a way to find how this mail got generated.

Re: FIND

Jeff_Traigle — Thu, 16 Mar 2006 17:22:52 GMT

Possibly being emailed to an alias on the system. Check /etc/mail/aliases to see if his username shows up anywhere. If you modify that file, you must run newaliases afterwards to generate the new database file that sendmail actually uses.

Re: FIND

Steven E. Protter — Thu, 16 Mar 2006 17:24:01 GMT

find <script directory> -exec grep -l emailaddress {} \;

Example

find /usr -exec grep -l myaddress@yahoo.com {} \;

You can seach the whole system if you wish.

find / -exec grep -l myaddress@yahoo.com {} \;

SEP

Re: FIND

Geoff Wild — Thu, 16 Mar 2006 17:25:35 GMT

Har to tell where it was generated - in /var/adm/syslog/maillog you fight be able to see when it was sent.

aliases would be the first place - he might be in there under a group...

Rgds...Geoff

Re: FIND

Hunki — Thu, 16 Mar 2006 17:33:43 GMT

Its ( the mail ) from one of the application ids on the system to the develop.

Re: FIND

Hunki — Thu, 16 Mar 2006 17:43:08 GMT

Currently searching the whole system as Steven suggested , doing a search through the subject which was there in the mail.

Re: FIND

Jeff_Traigle — Thu, 16 Mar 2006 17:43:38 GMT

Another place to look, in that case, is to see if there is a .forward file in the application account's home directory. This could also be used to distribute the mail to other people.

Re: FIND

Sanjay_6 — Thu, 16 Mar 2006 17:52:32 GMT

Hi,

Maybe you can find out the time the mail was received by the user and the id that sent it. Then check your /var/adm/syslog/mail.log file to see if it was sent from this server by that id and that may help you isolate the application that may have run at that time, maybe a cron job or something.

Hope this helps.

regds

Re: FIND

Hunki — Fri, 17 Mar 2006 10:57:36 GMT

Hard to find...:-(