MacOS – How to Trace the Origin of Outbound Spam Mail in Mavericks Server

emailmacososx-serversmtpspam

My Mavericks Server mail server has been compromised and has been sending reams of Nigerian royalty scam emails out. Where can I find log files which will enable me to track down the IP address these messages originated from (in case their is a machine with an infection on my network) and which credentials are being used to authenticate to the SMTP server?

Best Answer

You should be able to find that Information in /var/log/Mail.log and some more in /var/log/system.log.

Related Question