[SOLVED] How to find out who was logging by SMTP with password?

[anton.aleksandrov]

Hello,
How (which log, what to search for) can I find who was relaying emails through our Zimbra? Either through webmail or using authenticated connection? Which log file contains such info and how can I see "who" , "from where" and "when" was logging in?

Regards,
Anton.

[y@w]

/var/log/zimbra.log will tell you who logs in via SMTP (grep for saslauthd) and /opt/zimbra/log/audit.log will tell you who logs in via the web interface, etc.

[anton.aleksandrov]

Thank you.

Someone has sent a lot of emails through us on 26.Nov, but zimbra.log (with it's rotations) dates back to just 30.Nov. Is it possible to get the any useful info from other logs, which goes a bit more in the past - mail.*, messages?

[y@w]

If you are using Zimbra 5.0, you could do a zmmsgtrace for that day to see where the emails went and who sent them. I'm not sure what other useful information you would find though.

[ArcaneMagus]

The mail.* files, if they go back further then zimbra.log, might contain useful information about the postfix lines, messages might contain the sasl lines.