Hi, I had a spammer in my system which sent many mails to many domains, and as I have tcp.smtp rules it should did it from my own dialups, so I have the syslog with the following messages.. Is there any way to know the IP from this guy?. And How can I filter per Subject instead of From???. Here's the log:Nov 7 15:53:11 babel qmail: 942000791.265761 info msg 143554: bytes 18920 from <[EMAIL PROTECTED]> qp 1318 uid 101 Nov 7 15:53:11 babel qmail: 942000791.331364 starting delivery 6979: msg 143554 to local [EMAIL PROTECTED] Nov 7 15:53:11 babel qmail: 942000791.331556 status: local 1/10 remote 0/20 Nov 7 15:53:11 babel qmail: 942000791.527908 new msg 143555 Nov 7 15:53:11 babel qmail: 942000791.528148 info msg 143555: bytes 19408 from <> qp 1322 uid 108 Nov 7 15:53:11 babel qmail: 942000791.680963 starting delivery 6980: msg 143555 to local [EMAIL PROTECTED] Nov 7 15:53:11 babel qmail: 942000791.681167 status: local 2/10 remote 0/20 Nov 7 15:53:11 babel qmail: 942000791.715031 delivery 6980: failure: admin__:sintesoft.com:sintesoft.com/POP_user_does_not_exist,_but_will_deliver _to_/mail/vpopmail/domains/sintesoft.com/postmaster/Reason_for_failure:_/User_over_quota,_size_=_2299815/ Nov 7 15:53:11 babel qmail: 942000791.757477 status: local 1/10 remote 0/20 Nov 7 15:53:11 babel qmail: 942000791.860593 bounce msg 143555 qp 132ov 8 10:14:04 babel qmail: 942066844.193751 new msg 143539 Nov 8 10:14:04 babel qmail: 942066844.194014 info msg 143539: bytes 18547 from <[EMAIL PROTECTED]> qp 9352 uid 101 Nov 8 10:14:04 babel qmail: 942066844.266497 starting delivery 8091: msg 143539 to remote [EMAIL PROTECTED] Nov 8 10:14:04 babel qmail: 942066844.266685 status: local 0/10 remote 1/20 Nov 8 10:14:06 babel qmail: 942066846.278123 delivery 8091: success: 200.10.106.24_accepted_message./Remote_host_said:_250_Message_received:_19991 [EMAIL PROTECTED]/ Nov 8 10:14:06 babel qmail: 942066846.291431 status: local 0/10 remote 0/20 Nov 8 10:14:06 babel qmail: 942066846.291616 end msg 143539 Nov 8 10:14:18 babel vpopmail[9359]: virtual POP for matias@ from 200.43.4.2 Nov 8 10:14:21 babel qmail: 942066861.339228 new msg 143539
