Monitoring Malicious Activity

[bigdigillc]

One of my servers was recently blacklisted for sending a large amount of spam. I had no idea and don't really know how to stop it. I would really appreciate some pointers on how to eliminate the problem. Is there any way to monitor KLOXO for spam or to see all the email in and out everyday? ...and where it is coming from?


Thank you in advance for all your help.

[MRatWork]

Go to 'log manager'.

[Spacedust]

/etc/init.d/rsylogd restart or /etc/init.d/syslog restart
tail -f /var/log/maillog

[Actual]

I highly recommend installing CSF, I recently followed chrisf's instructions here:-

http://forum.mratwork.com/kloxo-mr-tips-and-tricks/installing-csf-alongside-kloxomr-(how-to)/

I can also recommend Chris's sendmail script to keep track/stop spam coming from your server:

http://forum.mratwork.com/kloxo-mr-tips-and-tricks/sendmail-userid-usage-limits-(script-v1-1b)/

Both generate good log files and CSF can alert you to suspicious server activity via email