Wrong bandwidth counting e-mail one user

A get a mail from a user he gots a lot of datatraffic on the mail, but when i checked the exim log files. The traffic is not much.

Advanced Search
Date Apache Email Ftp Pop Imap DirectAdmin Other Total Email Deliveries (Sent)
2012 05 01 31.7 MB 280.7 MB 0.742 MB 0.00 KB 0.00 KB 0.00 KB 0.00 KB 313.1 MB 250 (68)
2012 05 02 15.5 MB 3.23 GB 11.2 KB 0.00 KB 0.00 KB 0.00 KB 0.00 KB 3.24 GB 230 (26)
2012 05 03 32.7 MB 8.46 GB 0.00 KB 0.00 KB 0.00 KB 0.578 MB 0.00 KB 8.49 GB 395 (17)
2012 05 04 2.99 MB 4.47 GB 0.00 KB 0.00 KB 0.00 KB 0.00 KB 0.00 KB 4.47 GB 171 (0)
2012 05 05 28.2 MB 91.4 KB 0.00 KB 0.00 KB 0.00 KB 0.00 KB 0.00 KB 28.3 MB 13 (1)
2012 05 06 19.9 MB 2.01 MB 4.22 MB 0.00 KB 0.00 KB 0.704 MB 0.00 KB 26.8 MB 24 (10)
total 130.9 MB 16.43 GB 4.97 MB 0.00 KB 0.00 KB 1.28 MB 0.00 KB 16.57 GB 1083 (122)

And with eximstats i get this result.

Exim statistics from 2012-04-22 04:03:43 to 2012-05-07 10:28:03

TOTAL Volume Messages Addresses Hosts At least one addr
Delayed At least one addr
Failed
Received 957MB 25766 5221 110 0.4% 415 1.6%
Delivered 1009MB 26940 27387 415
Rejects 24398 12378
Temp Rejects 46 42

Hello,

Please tell us what is your question?

The question is one user on the server gets big data on email usage 4gb or 8gb for the day. But did not send it or receive it.
And when i checked the exim logs i dont see big messages in it.
Coulndt it be een wrong calculation of the mail the normal avg use of the user is 1.5 gb montly and nog 14 gb in few days. On email

OK, you should read exim logs I guess line by line or with exigrep, that it is for:

I know for sure, that if an outgoing email was not delivered for any reason from the first time it gets into a queue and stays there for some time until exim tries it re-send. And if it fails again it stays in queue according to your configuration of retry section in exim.conf. And every try of delivery doesn't matter how success was it gets counted by exim.pl and lately it will be counted by directadmin. And here comes a question, how does it get logged in /var/log/exim/mainlog? Does a size of email from queue gets into exim logs on every delivery try? And if it gets into exim logs does eximstats take it into consideration when showing stats?

Here are my thoughts and ideas for investigation. I hope you've got a direction now, and please update us with your findings.

Stil get weird accounting of data in exim and directadmin. One user uses now a email data of 5gb way to much i have here a little log of the /etc/virtual/usage of the user.

22564717=type=email&email=?????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=??????&method=incoming&id=&path=/usr/local/directadmin/custombuild
22564717=type=email&email=??????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
22564717=type=email&email=??????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=???????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=???????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=???????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
22564717=type=email&email=??????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
22564717=type=email&email=?????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=??????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=???????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
22564717=type=email&email=???????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
22564717=type=email&email=???????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=????????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild
24311415=type=email&email=????????.nl&method=incoming&id=&path=/usr/local/directadmin/custombuild


????? = email account user

I see many usage size the same what would this or could be.

That's incoming messages.... so it might be even spam...

Thanks for fast reply, zeiter i have made it closer the spamblocker. And wil see what happens. But weird 5gb of spam what p@rn farmer would that be

I don't see the whole situation, unless that is all his email. Note, even it's all what you see now in /etc/virtual/usage that is only for the current day.