Hi
As far as surgemail is concerned inbound mail connections
come from webmail
which is indeed 127.0.0.1 (or whatever it is set to). So the
message
delivery logs will not be very useful.
However the webmail.log file should show entries along the
following lines
which are more help:
for attempted login:
5 18:47:27 [3358] Info: ***: IP=1.2.3.4 NAME=someuser
utoken=(NULL)
for a logged in webmail session:
5 18:47:37 [3381] Info: ***: IP=1.2.3.4 NAME=(NULL)
utoken=someuser mydomain.com 127.0.0.1:143_~2-xxxxxx
Also the messages in question if you are archiving these /
or have access to
them should have the following header:
X-Originating-IP: 1.2.3.4
which gets added by webmail unless you have explicitly
disabled it.
Marijn
--------------------------------------------------
From: <surgemail-list netwinsite.com>
Sent: Wednesday, December 12, 2007 9:29 PM
Newsgroups: netwin.surgemail
Subject: How to tell ipaddress of web mail connection
> Hi.
> We have had problems with a spamer on our web mail
system, How do I track
> that in the logs ?
> All I see is mail comming from 127.0.0.1, how do I find
the address of
> http connection ?
>
> thanks
>
|