How to find source of e-mail ?

[dandan123]

One of my users wants to stop an e-mail generated by a host every 15 minutes.

I know the account and the host from where it's originating.

I've checked the crontabs and didn't find anything there.

I then did a string search looking for the subject of the e-mail and also any file containing mail or mailx but no luck.

Any suggestions ?

 

[Annihilannic]

Try replacing the mail or mailx binary temporarily with a script which simply saves ps -ef output to a file, then after the next time the job runs you can examine the process' ancestry to figure out what's running it.

Another possibility is that it is calling /usr/lib/sendmail (or some other MTA) directly though.

Annihilannic.

 

[dandan123]

When I finally got downtime for this server, simply restarting sendmail did the trick.