Unknown mail going out

[Jesse Delk]

I'm running TRU64 Unix 4.0F on an ES40.

My network admin says this box has mail going out...sent to a bogus user/address that does not exist...let say user its going to is "somebody". Its being sent consistently and is slowing down his email server.

How can I find out what process is sending out this email?

[Mark Poeschl_2 · Accepted solution]

Is sendmail on your Unix box set up to relay all mail to your mail server? If so there will likely be entries in /var/adm/syslog.dated/current/mail.log.

There may be some extra logging you could temporarily turn on on the mail server, too.

If neither of those work you could also use the 'tcpdump' utility on the Unix box. See the tcpdump man page for instructions.

[Kasper Haitsma]

I assume you only have sendmail installed on yuor system.

The sending process, can be found in the mail.log, but that will be sendmail. the parent is a lot harder, if it's a shell, or an application.
It can maybe derived from the content. If mail cannot be delivered, it is probably queued somewhere. on a unix style system, one can usually read the content of the message in the mqueue directory. so check with the mailq command (mailq is short for "sendmail -bp", seen manpage of mailq) if it is queued on your system, and checkout the content of the message.

If it is not queued on a unix system, you might need to catch it on yours, before it is sent out, by putting sendmail in queue mode, see O'Reilly's sendmail book paragraph 34.8.16 (and 34.8.16.4). this way all outgoing mail will be stored in the mqueue directory, and you need to invoke "sendmail -q" to process the queue, so mail will be sent off the system, after you have investigated the email. BE AWARE, ALL mail will be kept on the system, untill you process the queue!

HTH

[Jesse Delk]

Thanks, your suggestions helped me find the issue.