Hello,
I currently have a small issue on a server: somebody is generating lots
of pop3 traffic, and I still can't find who it is. It's on a server with
hundreds of domains and users, and using ntop or netstat didn't helped
yet: it's not all from a single ip address. The only fact for sure: if I
stop pop3d, the traffic is going down (mrtg).
What I'd need is to have better logging of pop3 transactions, if
possible not by using recordio. At the moment, the pop3d log looks
like:
@40000000465451ae2796b26c tcpserver: pid 78232 from 195.134.148.xx
@40000000465451ae27971be4 tcpserver: ok 78232
0:212.103.xx.yy:110 :195.134.148.yy::11976
@40000000465451ae2b50c884 tcpserver: end 78232 status 256
@40000000465451ae2b50dff4 tcpserver: status: 1/40
@40000000465451b01e354c9c tcpserver: status: 2/40
@40000000465451b01e3b7aa4 tcpserver: pid 78290 from 217.162.244.xxx
@40000000465451b01e3cce7c tcpserver: ok 78290
0:212.103.xx.yy:110 :217.162.244.xxx::63246
@40000000465451b0219e54b4 tcpserver: end 78290 status 256
@40000000465451b0219e6c24 tcpserver: status: 1/40
[...]
And it's not very helpful :) I don't see any tcpserver options about
logging bytes and domains, idem for the qmail-popup and qmail-pop3d or
vmailmgrd's checkvpw.
What would you do?
Thanks & regards,
Olivier
|