Charles Richard:
> > Before you can stop the spam, you must find out how it enters Postfix.
> > You will have to examine the maillog (mail.log, or whatever) file
> > to find out if it enters via smtpd (network) or via pickup (local
> > submission). It if arrives from the network, perhaps a user account
> > was compromised. If it comes from a local web application, that
> > requires different measures.
> >
> > How can I tell if it enters via smtpd or via pickup? The first message is
> see starts in the following manner:
>
> Aug 21 09:59:49 servername postfix/qmgr[28270]: 1583354444F: from=<
> x...@xxxxx.com>, size=2151, nrcpt=14 (queue active)
That is NOT the first logfile message. The first logfile message
is from pickup or smtpd (on some rare systems, from qmqpd).
The first logfile message may be in a different logfile depending
on the logfile rotation policy of your particular UNIX distribution,
and on the Postfix queue file expiration policy (default 5 days).
Wietse
