You should be able to find the actual source IP in /opt/zimbra/jetty/logs/access_log.*
When you use the HTML client, the server talks to itself... though I'd expect the IP address to be 127.0.0.1, not the server's public IP. ZCS 5.0.5 or so fixed the logs to include the original rather than proxied IP, so if you're running a recent version, I don't know what the deal is.
You're sure you don't have some forgotten cron job on the local box? |