Tracing script spamming

Open exim.conf

pico -w /etc/exim.conf

Find this;

hostlist auth_relay_hosts = *

After hostlist auth_relay_hosts = *

add

log_selector = \ +address_rewrite \ +all_parents \ +arguments \ +connection_reject \ +received_sender \ +received_recipients \ +subject \

Save and restart exim.

Then you can see extra information for each smtp connection made to server. If any user on your server sending emails with php scripts then you can see path of script folder too. Here is an example;

2003-06-27 14:06:18 cwd=/home/usersite/public_html/forums 3 args: /usr/sbin/sendmail -t -i 2003-06-27 14:06:18 19W0QE-0001Nr-1b "nobody@srv05.primenet.cc" from env-from rewritten as ""usersite.com" <minx@usersite.com>" by rule 1