Tracking mailnull

[Chriz1977]

Hi

Im getting a lot of these messages

This is an automated status warning from xxxxxx.com. The process (2187) has exceeded defined resource limits, as such a kill signal was invoked from the process resource monitor.

- Event Summary:
USER: mailnull
PID : 2187
CMD : /usr/sbin/exim
CPU%: 0 (limit: 85)
MEM%: 0 (limit: 15)
PROCS: 32 (limit: 10)

It seems to be a mass mailing program but i need to trace whos using it. How can I do that?

Thanks in advance

[ujr]

Is this a freeBSD box? (Just curious since the FreeBSD port builds exim to usually run using user "mailnull" and group "mail")

Take a good look at your exim logs and see who is sending..

/var/log/exim_mainlog
/var/log/maillog

Also the message that you posted really doesn't mean much, since it depends on how much resources you have to begin with and what you set it to alert you. Make sense?

And I would also recommend taking a good look at your domlogs /etc/httpd/domlogs for the periods where you are getting these resource limit emails. You can search them using grep.

If you think there is something strange going on, and don't know what to do, think about hirign someone who can help you out. There are plenty of people around here offering such services.