How can I track outgoing emails from Unix and Sendmail?

Question

I am starting the FreeBSD server and I was sent a warning that spam was sent from my server. I do not set it as an open relay, and I configured the sendmail configuration. I would like to know who sends the email by email with my username, email, and also how much mail they send. I would like to run a log report similar to how this is done when processing Apache server logs.

What are my options?

Answer 1

One idea is for alias sendmail to be a custom script that simply mows sendmail arguments to the end of the log before calling sendmail in the usual way.

Answer 2

If FreeBSD has a default configuration, you have only one way to handle output mail, make sure that you send through the sendmail system to /etc/mail .

All output mail should be logged /var/log/maillog

Answer 3

Can you give some sample logs? I think you would be best off looking through them with grep or cut to get the sent source / recipients. Alternatively, you can write a Perl script to automate it as soon as you have the correct regular expression. That would be the best option.

Answer 4

You can also control all system calls with the write and read functions by doing:

 ps auxw | grep sendmail | awk '{print"-p " $2}' | xargs strace -s 256 -f 2>&1 | grep -E $'@|(([0-9]+\.){3}[0-9]+)' | tee -a "/var/log/sendmail-logs.log" 

This will give you direct access to information; you cannot go deeper, I think.