Mail queue loaded

[waiel]

HI
I'm facing a problem with my server. it's in production and contains 130 clients

the mail queue get loaded easily with spams
the queue now have 172692 Emails most of what i can see all spam
and it's sent from unknown user

i have disabled the user nobody from sending e-mails but still it will continue to send e-mail as nobody ..

i also checked the logs and created a script to watch the account

some of the e-mails are sent using e-mail exploits in the clients mail scripts/forms

My problem is the exim uses up all the ram ( the server have 3 GB of ram and what left free is 19 MB) and CPU usage ( always goes up to 50 till 200 )
which affect other process and will slowdown the server

so is there a way to solve this ?
Is there a way to drop all the e-mails that is not originated from a local user ?!

Thanks

[AndyReed]

You need to find who is sending out SPAm from your server. It could be one of your clients or a hacker. I suggest you search these forums, since this topic was covered so many times. Good luck!

[darkelder]

Does'nt anyone here have a script to help waiel clean its exim mail spool from some keyswords he found on emails?

[hergy80]

Searching the forums gives great results:

http://forums.cpanel.net/showthread....ean+mail+queue

[Lyttek]

Does'nt anyone here have a script to help waiel clean its exim mail spool from some keyswords he found on emails?

Sure, but that's attacking the symptoms, not the underlying problem.

[waiel]

Searching the forums gives great results:

http://forums.cpanel.net/showthread....ean+mail+queue

i already have this but i want to clean it automaticaly
which is to check if the message already compleated 24 hour in the queue if so delete it

[hergy80]

Sure, but that's attacking the symptoms, not the underlying problem.

i already have this but i want to clean it automaticaly
which is to check if the message already compleated 24 hour in the queue if so delete it

Lyttek is right, you really need to find the problem. We recently had an SQL Spam injection on a webcalendar script that caused about 22K e-mails to be send from our mailer to a specific domain (I believe it might have been part of a DoS attack). But you really need to find the problem area first, then just use these scripts to clean up the damage after you've stopped and fixed the problem.