monitor smtp volume by user?

[Tormente]

is there any way to monitor SMTP by user?

I know I can monitor it by domain... but we are afraid we might have a spammer in our midsts (actual user, turned bad) using our main domain name (where we have ~30 users) and need to weed him out. I feel being able to see how much mail going out by user would really help.

Also any other ideas on how to find a spammer from within would be greatly appreciated.

 

[dynaweb]

Find user activity in maillog

# grep -i --color -8 'user@domain.net' /usr/local/psa/var/log/maillog

You may have to run it once for each suspect.

Search queue for terms

If you suspect your user is spamming people with Viagra ads, run this

# find /var/qmail/queue/mess -type f -exec grep -i "viagra" 2> /dev/null {} \; -print -exec ls {} \;

which may output stuff like this:

""""""""""""
Now you can order Genuine Viagra directly from Pfizer
/var/qmail/queue/mess/6/2327399
""""""""""""

Then you can nano or pico that file for info on WTF it's coming from.