How to configure Zimbra mail queues to reveal origin IP?

[bhwong]

We need to find out the IP address of our infected PCs spamming on Zimbra. Unfortunately Zimbra mail queues show the origin IP of every sender as 127.0.0.1, which is just useless information.

Thanks,
Boon Hong.

[dalmate]

You can see the origin IP of the mail in the log of zimbra.
Please see in /var/log/zimbra.log.

[bhwong]

I have checked the log and it doesn't show where this indiasemagazine@gmail.com IP is from:

Aug 18 09:36:29 home amavis[20371]: (20371-13) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20100818T045701-20371: <indiasemagazine@gmail.com> -> <xxx@xxx.com.sg> SIZE=5027 BODY=7BIT Received: from mail.example.com ([127.0.0.1]) by localhost (mail.example.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <xxx@xxx.com.sg>; Wed, 18 Aug 2010 09:36:29 +0800 (SGT)

[dalmate]

No, you must check the log in /var/log/zimbra.log.
Please with the "postfix/smtpd" and "From" keyword, you will found what you want

[bhwong]

Hi Dalmate,

The log only show external IP addresses. For internal, it still show 127.0.0.1 which is not helpful for us to identify which PC is infected:

Aug 19 08:00:59 home postfix/smtpd[27200]: connect from localhost[127.0.0.1]

[bhwong]

I have open an RFE on this, please vote for it at: Bug 50112 &ndash; Origin IP only show 127.0.0.1