Wietse Venema:
> Christian Ro??ner:
> > Hi,
> >
> > I have looked at man 5 postconf, if there exists an option to add the
> > envelope sender to the postfix smtp client, but I didn'T find one.
> >
> > If an account gets stolen and this account starts sending lots of mails, it
> > often leads to RBLs. If you try to find the account that was compromised, a
> > first command would be something like:
> >
> > grep "postfix/smtp\[" mail.log | grep -i reject
>
> You could collate.pl, included with Postfix source code, and posted
> here regularly.
>
> Some people might want to correlate some other property (size?)
> with 'reject'. Better not to try to do all that inside Postfix.
perl collate.pl /the/log/file | perl -e '
$/="";
while (<>) {
print "$1\n" if /from=(\S+),.+postfix\/smtp\[.+status=bounced/s;
}
' | sort | uniq -c | sort -nr | less
Or put everything on one line.
Wietse
