The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

mailnull /usr/sbin/exim

Discussion in 'E-mail Discussions' started by t9clkclnr, Feb 3, 2007.

  1. t9clkclnr

    t9clkclnr Well-Known Member

    Joined:
    Jun 11, 2004
    Messages:
    254
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Southern California
    Recevied about 40K emails into the queue within 3 hours
    Sent server into 96 - load. Don't know what is going on, or how to deduce

    mailnull 7131 0.0 0.2 12168 5444 ? S Jan31 0:47 eximstats
    mailnull 1301 0.0 0.1 8928 2136 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtD-0000Kn-JM
    mailnull 1409 1.2 0.1 9736 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000Me-4j
    mailnull 1412 0.0 0.1 8352 2136 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000MY-1b
    mailnull 1437 0.0 0.0 8092 908 ? Ss 21:18 0:00 /usr/sbin/exim -bd -q60m
    mailnull 1442 0.0 0.0 7940 856 ? Ss 21:18 0:00 /usr/sbin/exim -tls-on-connect -bd -oX 465
    mailnull 1451 1.2 0.1 8288 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000Mo-8n
    mailnull 1527 1.6 0.1 10080 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000Nk-Nw
    mailnull 1530 3.6 0.1 9452 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtG-0000O3-V3
    mailnull 1539 3.0 0.1 8712 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000Oh-B1
    mailnull 1554 1.0 0.1 8708 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000Oo-Fp
    mailnull 1564 1.3 0.1 8852 3956 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000On-EQ
    mailnull 1581 1.0 0.1 9600 3956 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PB-LV
    mailnull 1584 4.0 0.1 9292 3916 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PD-Lj
    mailnull 1586 0.0 0.1 9356 2728 ? D 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000P9-Ks
    mailnull 1591 3.0 0.1 9900 3952 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PT-Sa
    mailnull 1594 2.5 0.1 10140 3956 ? Ds 21:18 0:00 /usr/sbin/exim -Mc 1HDXtH-0000PU-T6
    mailnull 1604 5.0 0.1 10048 3924 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Ph-3U
    mailnull 1608 3.5 0.1 9936 3916 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Pt-8A
    mailnull 1610 0.0 0.1 9600 2184 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Pe-3C
    mailnull 1617 3.5 0.1 9648 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Q3-CR
    mailnull 1620 0.0 0.1 9784 2144 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Px-9S
    mailnull 1623 3.5 0.1 9648 3924 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000Q6-EF
    mailnull 1625 4.0 0.1 9928 3920 ? Ss 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QC-HS
    mailnull 1633 0.0 0.1 10136 2140 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000PZ-0r
    mailnull 1635 0.0 0.1 10136 2180 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000PZ-0r
    mailnull 1638 0.0 0.1 9652 2144 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QE-Ig
    mailnull 1642 0.0 0.1 10104 2192 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QH-K7
    mailnull 1653 0.0 0.1 9656 2184 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QO-Ts
    mailnull 1654 0.0 0.1 10212 2176 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000QV-6f
    mailnull 1657 0.0 0.1 8304 2132 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtI-0000QM-QA
    mailnull 1666 0.0 0.1 8700 2180 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000QX-H6
    mailnull 1667 0.0 0.1 8512 2180 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000Qh-NQ
    mailnull 1669 0.0 0.1 9532 2112 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000QZ-Jg
    mailnull 1674 0.0 0.1 9692 2112 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtJ-0000Qm-UR
    mailnull 1675 0.0 0.0 8784 1816 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Ph-3U
    mailnull 1676 0.0 0.0 8968 1812 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtH-0000PD-Lj
    mailnull 1677 0.0 0.0 8112 1808 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Pt-8A
    mailnull 1680 0.0 0.0 8840 1800 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000QC-HS
    mailnull 1681 0.0 0.0 8952 1804 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Q6-EF
    mailnull 1682 0.0 0.0 8464 1804 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtI-0000Q3-CR
    mailnull 1683 0.0 0.0 7944 1812 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtG-0000O3-V3
    mailnull 1684 0.0 0.1 10292 2096 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtK-0000Qx-51
    mailnull 1685 0.0 0.1 10292 2100 ? S 21:18 0:00 /usr/sbin/exim -Mc 1HDXtK-0000Qx-51
    mailnull 1686 0.0 0.0 9164 1752 ? D 21:18 0:00 /usr/sbin/exim -t -oem -oi -f <> -E1HDXtH-0000Oh-B1
    mailnull 1688 0.0 0.0 8100 764 ? S 21:18 0:00 /usr/sbin/exim -bd -q60m
    root 1525 0.3 0.0 4504 1112 ? S 21:18 0:00 antirelayd
     
  2. mohit

    mohit Well-Known Member

    Joined:
    Jul 12, 2005
    Messages:
    553
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Sticky On Internet
    hi,
    most probably a BULK mailler on the box, look for the messages in Queue, whats is being relayed, who's account is originating those.

    see ya,
    manu
     
  3. t9clkclnr

    t9clkclnr Well-Known Member

    Joined:
    Jun 11, 2004
    Messages:
    254
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Southern California
    Found it...

    grep'd for the sendmail, and located someones attempt at a php mailer that was being exploited.

    Server load got to 199...and was still trucking. Awesome.

    anyway, cleared mail queue, restarted server and removed offensive scripts and slapped the hand of the user. (albeit a friend)...punk

    Anywhos, all is good, the forums here helped, once I found the right 3 threads to view.
     
Loading...
Similar Threads - mailnull usr sbin
  1. zuronam
    Replies:
    2
    Views:
    183

Share This Page