Large amounts of email alert

[flamewalker]

Got a notification yesterday that my primary user has sent over 2k emails. I have over 500 email accounts associated with the user and domain attached to the user...

Is there an easy (or not quite so easy) way to figure out who, or what email account(s) the email came from?

TIA!
Jamey

 

[scsi]

Check the mail logs

 

[flamewalker]

What, and count each email sent from each user? There has to be an easier way to see what email login has sent the most emails...

 

[scsi]

eximstats -txt /var/log/exim/mainlog | more

 

[flamewalker]

Thanks.

Unfortunately I don't see where it lists the virtual users, just local users for sent messages, ie:

Top 50 local senders by message count
-------------------------------------
  Messages      Bytes    Average   Local sender
     23350      409MB       18KB   mail
       135      490KB       3716   apache
       133       91KB        700   root
         3       2829        943   diradmin

Any ideas how I could break it down further, say, by virtual email account (ie [email protected])?

 

[scsi]

-byemail works

eximstats -txt -byemail /var/log/exim/mainlog

 

[flamewalker]

excellent, thank you!