Byteplant Forum

Home » CleanMail Support » CleanMail Server Talk » Confused with log...
Confused with log... [message #1527] Sun, 29 October 2006 12:12
miffee79
Messages: 2
Registered: October 2006
Junior Member
Hi All Smile

Hoping you can help. I was looking at my log this morning and there is a lot of this:

Oct 29, 2006, 11:03:51 Session 0: Connection from xxx.xxx.xx.xxx accepted on ***.***.***.***:25
Oct 29, 2006, 11:03:51 Session 0: 220 mail.xxxxx.com
Oct 29, 2006, 11:04:00 Session 0: EHLO computer-9ccogs
Oct 29, 2006, 11:04:00 Session 0: 250-DSVR000915 Hello [217.174.249.81]
Oct 29, 2006, 11:04:00 Session 0: 250-SIZE 52428800
Oct 29, 2006, 11:04:00 Session 0: 250-AUTH LOGIN CRAM-MD5
Oct 29, 2006, 11:04:00 Session 0: 250 OK

Can anyone tell me if this is good or bad?

Cheers,

Matt



Post Edited (10-29-06 12:13)
Re: Confused with log... [message #1528 is a reply to message #1527] Sun, 29 October 2006 20:52 Go to previous message
Heidner
Messages: 121
Registered: February 2005
Senior Member
That is a normal negotiation sequence for starting up a mail session.


I presume the ***.*** and the xxx.xxx are your changes.
Re: Confused with log... [message #1529 is a reply to message #1528] Sun, 29 October 2006 20:57 Go to previous message
miffee79
Messages: 2
Registered: October 2006
Junior Member
Hello Smile

Thank you for your reply. Yes, they are my changes. The only reason I asked was because NST normally gets about 1500 emails a day and yesterday it got 6900 and only 63 were not spam, the rest were rejected as expected. It threw me a bit.

Thanks again Smile

Matt
Re: Confused with log... [message #1530 is a reply to message #1527] Tue, 31 October 2006 07:36 Go to previous message
Heidner
Messages: 121
Registered: February 2005
Senior Member
Occassionaly you'll see some really nasty spikes. I normally only see four or five hundred e-mails a day... but I also have seen spikes where it jumps up to seven or eight times the normal. When I see that happening - if I can see a pattern on the ip addresses - I just null route the whole IP block to cut down the noise. This time of the year it is tends to be much higher...
Re: Confused with log... [message #1531 is a reply to message #1527] Wed, 01 November 2006 15:35 Go to previous message
iyuvalk
Messages: 26
Registered: December 2004
Junior Member
Hi,

Sometimes you'll see this because spammers occassionaly try to refresh their e-mail addresses by sending the spam to a@yourdomain, b@yourdomain, c@yourdomain etc.
We get that from time to time, what I usually do with this is to search the NST log for rejected email addresses that I could use as honeypot addresses and refresh my honeypot addresses list.

Hope that was a bit helpful for you,

Yuval.
Previous Topic: Attachment Filter: Message violates MIME standards: MIME syntax violation
Next Topic: License count
Goto Forum:
  


Current Time: Wed Dec 07 23:06:58 CET 2016