The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

View Sent Summary - remote

Discussion in 'General Discussion' started by GoWilkes, Oct 1, 2012.

  1. GoWilkes

    GoWilkes Well-Known Member

    Joined:
    Sep 26, 2006
    Messages:
    367
    Likes Received:
    1
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    In WHM, under the "View Sent Summary" option, what does the user "-remote-" signify?

    I ask because I have a server that hosts a handful of small accounts, but -remote- is showing a relatively large number of emails. In the last 24 hours, it's showing 4,494 total emails, 3,437 sent successfully, 1,127 failures, and 1,162 failed + deferred.

    For a server that usually sends about 300 emails a day, that's a lot!

    Is this implying that there's a security issue somewhere?
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,664
    Likes Received:
    646
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    The "-remote-" user should be for incoming and outgoing mails that are not local. Effectively, it's used for when an email is sent out of the server or when an email is sent to the server and the sender or recipient are remote.

    You should be able to click on the "-Remote-" user to see the specific emails it's showing statistics for to determine if they are legitimate.

    Thank you.
     
  3. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Hello,

    In instances, the -remote- user might not show any additional details. If this is the case, you could run the following in command line to obtain a list of the users in command line:

    Code:
    mysql -e "SELECT * FROM eximstats.sends WHERE user = '-remote-'\G" > /root/mysqlremotesends
    mysql -e "SELECT * FROM eximstats.smtp WHERE deliveryuser = '-remote-'\G" > /root/mysqlremotesmtp
    The first command will print the -remote- user entries in eximstats.sends to /root/mysqlremotesends file, while the second command will print the -remote- user entries in eximstats.smtp to /root/mysqlremotesmtp file.

    Thanks!
     
  4. opentoe

    opentoe Active Member

    Joined:
    Feb 6, 2013
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    cPanel Access Level:
    Website Owner


    Thank you for that. I did run the commands and the first one produced a large file with all these in it. I think I'm getting hit hard or something by Google. Is there a way to stop this? I input 68.18.0.0/16 into my DENY file which is the entire IP range, right?



    mailtime: 2014-01-31 05:50:24
    msgid: 1W94BU-0009ns-Gu
    email:
    processed: 0
    user: -remote-
    size: 0
    ip: 64.18.3.87
    auth: unauthorized
    host: exprod8ob104.obsmtp.com
    domain:
    localsender: 0
    spamscore: NULL
     
  5. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,664
    Likes Received:
    646
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Could you elaborate on the other symptoms that lead you to believe Exim is under attack? For instance, do you notice specific error messages in /var/log/exim_mainlog or increased server load?

    Thank you.
     
Loading...

Share This Page