\t\t\t\tThe server is saturated with SPAM. There are many messages in the queue. The mail is sent slowly.
\nArticle ID: 766
\nLast Review: Mar,16 2009
\nAuthor: Daria Taranova
\nLast updated by: Daria Taranova APPLIES TO:<\/p>\n
* Plesk 7.5.x Reloaded
\n * Plesk 9.x for Linux\/Unix
\n * Plesk 8.x for Linux\/Unix<\/p>\n
Resolution
\nFirst check that all domains have the option ‘Mail to non-existing user’ set to ‘reject’ but not to ‘forward’. You can
\nchange this setting to all domains using “Group Operations” in the “Domains” tab in Parallels Plesk Control Panel. The
\noption “Reject mail to nonexistent user” is available since Parallels Plesk Panel 7.5.3.<\/p>\n
Also, please, check that all the IPs and networks in the white lists are reliable and familiar to you.<\/p>\n
Check how many messages are in the queue with Qmail:<\/p>\n
If the queue has too many messages, try to discover the source of SPAM.<\/p>\n If mail is being sent by an authorized user but not from the PHP script, you can run the command below to find the user The path to ‘maillog’ may differ depending on the OS you are using.<\/p>\n The next step is to use is “qmail-qread”, which can be used to read the message headers:<\/p>\n This shows the senders and recipients of messages. If the message contains too many recipients, probably this is spam. Examine the message and find the line “Received” to find out from where it was sent for the first time, for example, if it means that this message was sent via a CGI by user with UID 10003. Using this UID it is possible to find the domain:<\/p>\n If the ‘Received’ line contains a UID of a user ‘apache’ (for example invoked by uid 48) – it means that spam was sent You can also apply KB article which describes the procedure of discovering which domains are sending mail through PHP Lines in Received section like<\/p>\n mean that the message has been accepted and delivered via SMTP, and that the sender is an authorized mail user.\t\t<\/p>\n","protected":false},"excerpt":{"rendered":" The server is saturated with SPAM. There are many messages in the queue. The mail is sent slowly. Article ID: 766 Last Review: Mar,16 2009 Author: Daria Taranova Last updated by: Daria Taranova APPLIES TO: * Plesk 7.5.x Reloaded * Plesk 9.x for Linux\/Unix * Plesk 8.x for Linux\/Unix Resolution First check that all domains […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,11],"tags":[],"class_list":["post-23","post","type-post","status-publish","format-standard","hentry","category-linux","category-plesk"],"_links":{"self":[{"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=\/wp\/v2\/posts\/23","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=23"}],"version-history":[{"count":0,"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=\/wp\/v2\/posts\/23\/revisions"}],"wp:attachment":[{"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=23"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=23"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kb.toderu.ro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=23"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}# \/var\/qmail\/bin\/qmail-qstat
\nmessages in queue: 27645
\nmessages in queue but not yet preprocessed: 82<\/code><\/p>\n
\nthat has sent the most messages (available since Plesk 8.x). Note that you must have the ‘SMTP authorization’ activated
\non the server to see these records:<\/p>\n# cat \/usr\/local\/psa\/var\/log\/maillog |grep -I smtp_auth |grep -I user |awk '{print $11}' |sort |uniq -c |sort -n<\/code><\/p>\n# \/var\/qmail\/bin\/qmail-qread
\n18 Jul 2005 15:03:07 GMT #2996948 9073
\ndone remote user1@domain1.com
\ndone remote user2@domain2.com
\ndone remote user3@domain3.com
\n....<\/code><\/p>\n
\nNow try to find this message in the queue by its ID ( # 2996948 in our example):<\/p>\n# find \/var\/qmail\/queue\/mess\/ -name 2996948<\/code><\/p>\n
\nyou find:<\/p>\nReceived: (qmail 19514 invoked by uid 10003); 13 Sep 2005 17:48:22 +0700<\/code><\/p>\n# grep 10003 \/etc\/passwd<\/code><\/p>\n
\nthrough a PHP script. In this case, you can try to find the spammer using information from spam email (address from\/to
\nor any other information). It is usually very difficult to discover the source of SPAM. If you are absolutely sure that
\nthis time there is a script which sends SPAM (tail grows rapidly for no apparent reason), you can use the following
\nscript to know what PHP scripts are running at this time:<\/p>\n# lsof +r 1 -p `ps axww | grep httpd | grep -v grep | awk ' { if(!str) { str=$1 } else { str=str\",\"$1}}END{print str}'`
\n| grep vhosts | grep php<\/code><\/p>\n
\nscripts.<\/p>\nReceived: (qmail 19622 invoked from network); 13 Sep 2005 17:52:36 +0700
\nReceived: from external_domain.com (192.168.0.1)<\/code><\/p>\n