[no subject]

If you mean the apache access logs, I've been doing that and I'm not 
seeing any likely matches. I can see in the maillog the time each 
message went out. It's pretty consistent... like ever 30 seconds 2 or 3 
go out. I've tried to match those times with any apache access_logs, but 
there is nothing being logged that is that consistent or even a likely 
script.

FWIW, I've also used rkhunter to check and make sure there are no 
rootkits on the server. We know it's not a user on the server because 
we'd have more header info and be able to see the user in the maillog.

Any tips?

Ryan


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00074" href="msg00074.html">[ale] tracking down a spammer on our box</a></strong>
<ul><li><em>From:</em> jkf at wolfnet.org (Jason Fritcher)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00000" href="msg00000.html">[ale] tracking down a spammer on our box</a></strong>
<ul><li><em>From:</em> Jerry.Yu at Voicecom.com (Yu, Jerry)</li></ul></li>
<li><strong><a name="00001" href="msg00001.html">[ale] tracking down a spammer on our box</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
<li><strong><a name="00004" href="msg00004.html">[ale] tracking down a spammer on our box</a></strong>
<ul><li><em>From:</em> flux at fictional-realms.com (Andrew Thornton)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00050.html">[ale] tracking down a spammer on our box</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00052.html">[ale] Success!! (mostly dumb luck) was Partially corrupt	partition table, Mandrake 10.1</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00004.html">[ale] tracking down a spammer on our box</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00074.html">[ale] tracking down a spammer on our box</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00051"><strong>Date</strong></a></li>
<li><a href="threads.html#00051"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>