View source for Spamming Plesk

Plesk is spamming!!

What to do:
1. Panic.

Postfix is really grumpy about working with you to figure out what it's doing.


'''E-mails in queue:'''<br />
<pre>
function _line { echo "=======Emails in $DIR Queue======="; };cd /var/spool/postfix;ls -l|egrep -o "deferred|hold|active|corrupt|defer|maildrop"|while read DIR; do _line; ls -lA $DIR|wc -l; echo; done;cd - 1>/dev/null;
</pre>


'''Size of the queue:'''<br />
postqueue -p | grep -c '^[0-9A-Z]'


'''Print the messages in the queue with the UID:'''<br />
<code>postqueue -p</code>


'''Print the email message in the terminal:'''<br />
<code>postcat -q $UID</code>


== Check for originating scripts ==

In the php mail log:<br />
<code>grep eval /var/log/php_maillog| grep -Po "(?<=\[).*?(?=\()"|sort -b|uniq -c |sort -rnk1</code>

No php maillog (Booo!) We can still check the mail headers... but this is very SLOW:<br />
<code>for i in $(postqueue -p | grep '^[0-9A-Z]'| awk '{print $1}'); do postcat -q $i | grep 'X-PHP-Originating-Script'; done |  cut -d':' -f1- | sort -b|uniq -c|sort -rnk1</code>


This finds the script from the above... I think...<br />
<code>find $PATH  -type f -exec grep -Ea -o Script\:\ [[:digit:]]+\:[[:alnum:]]+\.php {} \;|sort|uniq -c|sort -rnk1</code>