Read Email Queue

[Puma1337]

Hi,

There is a message that is in my email queue mail "mailer-daemon" to "info@brochureweeklyj.com" that is failing to send. I am trying to figure out where this email came from.

Here is what the mail.log says:

Dec 7 00:41:13 mail postfix/smtpd[29973]: connect from localhost[127.0.0.1]
Dec 7 00:41:13 mail postfix/smtpd[29973]: 694C62686A9: client=localhost[127.0.0.1]
Dec 7 00:41:13 mail postfix/cleanup[29397]: 694C62686A9: message-id=<816738631.896.1260164426360.JavaMail.root@mail .myhealthyfit.com>
Dec 7 00:41:13 mail postfix/smtpd[29973]: disconnect from localhost[127.0.0.1]
Dec 7 00:41:13 mail postfix/qmgr[10668]: 694C62686A9: from=<>, size=1316, nrcpt=1 (queue active)
Dec 7 00:41:15 mail postfix/smtp[29398]: 31F7C26869E: to=<info@brochureweeklyj.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=48, delays=2.6/0/6.7/39, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=11261-20, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 694C62686A9)
Dec 7 00:41:15 mail postfix/qmgr[10668]: 31F7C26869E: removed
Dec 7 00:41:43 mail postfix/smtp[30008]: connect to smtprcvr.brochureweeklyj.com[208.86.250.82]:25: Connection timed out
Dec 7 00:41:44 mail postfix/smtp[30008]: 694C62686A9: to=<info@brochureweeklyj.com>, relay=none, delay=30, delays=0.38/0.05/30/0, dsn=4.4.1, status=deferred (connect to smtprcvr.brochureweeklyj.com[208.86.250.82]:25: Connection timed out)
Dec 7 00:41:46 mail postfix/smtpd[29973]: connect from localhost[127.0.0.1]

Is there any way for me to read this message or get any more information about it?

Thanks.

[ArcaneMagus]

Well it came from the web client, you might look into /opt/zimbra/log/audit.log, as for the contents if it is still in the queue you should just be able to go to the queue directory and view the contents of the message there...

[Puma1337]

Originally Posted by ArcaneMagus

Well it came from the web client, you might look into /opt/zimbra/log/audit.log, as for the contents if it is still in the queue you should just be able to go to the queue directory and view the contents of the message there...

Thanks for the response. Do you by chance know where the queue directory is located? I have tried searching, but can't seem to find it.

Thanks.

[ArcaneMagus]

/opt/zimbra/data/postfix/spool

[Puma1337]

Thanks for the location. Here is what is contained in the email:

CO 1316 600 1 0 1316T1260164473 415301Acreate_time=1260164473Arewrite_context=lo calS

Anyone have any idea what this means?

[Puma1337]

Just wanted to follow up on this in case anyone else experiences anything similar.

I went to /opt/zimbra/data/postfix/spool/deferred/[beginning number or letter of ID in queue]/[ID NUMBER]

The first time I tried to open the message, I did it in Notepad, and I got the result in the last post. Then I tried in wordpad and I could see the full message.

It turns out the email was a spam email that was received into someone's email and they had a Vacation Auto Responder turned on, so it was trying to send an email back to the spam sender, which obviously failed.

Hope this helps if someone needs it in the future.