<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
The "cut" command was simply pulling the wrong field. I tried it and had to adjust to field number 8 instead of 7. Try it that way:
<br />
<br />cat /var/log/maillog | grep from | cut -d " " -f8 | uniq -c | sort -nr | less
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br /><font size="2">
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: "Gregg" <greggk1@cox.net>
<br />
To: "'BlueOnyx General Mailing List'"
<blueonyx@mail.blueonyx.it>
<br />
Sent: Thu, 7 Jun 2012 14:04:09 -0700
<br />
Subject: [BlueOnyx:10749] sendmail log commands?
<br />
<br />> <span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">A
month or so ago there was discussions regarding trojans and backdoors and
checking your logs for who is sending email.<o:p /></span>
<br />> <span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">There
was one particular command that was given that seemed like it could work
nicely:<o:p /></span>
<br />> One way to find who is sending the most
e-mails is to use this command:
<br />> cat /var/log/maillog | grep from | cut
-d " " -f7 | uniq -c | sort -nr | less<o:p />
<br />> <o:p>
</o:p>
<br />> <span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">I
tried using that command on my system and it didn't give me the users that were
sending out email but rather the actual files that are in the mqueue folder. So
something like q57L4NQU004856 . I assume that is not the way it's supposed to
work :)<o:p /></span>
<br />> <span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Is
there something wrong with that command? Are there any useful commands that you
guys use to check out on your systems? :)<o:p /></span>
<br />> <span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"><o:p>
</o:p></span>
<br />> <span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Thanks.</span><o:p />
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>