Spamming from the server.

[desiguru]

Someone has been sending spam messages from my server. Is there any way I can figure out who might have done this?

[henrynowa39]

i would like to now this as well

[vanessa]

You need to check your mail logs - /var/log/exim_mainlog.

[garrettp]

1. Open Exim Advanced Configuration Editor in the WHM, add:
   

   log_selector = +all

2. Get the message ID from one of the spam messages
3. Search for the message ID in the mail log:
   

   grep <message-ID> /var/log/exim_mainlog

4. Look for particulars such as A=fixed_login:user@domain.com (someone is spamming through that email account) or cwd=/home/user/public_html/exploited_script.php (insecure script allowing spam to be relayed)
5. Change account password, notify user, or secure/delete/prevent access to the exploited script