Exim, queues and delivery.
WHAT THE QUEUE IS
Messages accepted but not yet delivered.
HOW TO SEE ITS SIZE
The mail queue command, counted.
WHAT A LARGE QUEUE INDICATES
A delivery problem, or outbound abuse.
WHAT TO ESTABLISH
Whether messages are incoming or outgoing, and who sent them.
WHY THAT MATTERS MOST
A compromised account sending spam fills the queue and destroys the server's reputation.
HOW TO SEE WHAT A MESSAGE IS
Inspect it by its queue identifier.
WHAT TO LOOK AT
The sender, the authenticated user, and the script that submitted it.
WHAT THE MAIL LOG SHOWS
Every acceptance, delivery attempt and failure.
WHAT TO SEARCH IT FOR
A message identifier, to follow one message through An address, to see all activity Authentication failures
WHAT TO DO ABOUT AN ABUSING ACCOUNT
Suspend it, change the password, and find how it was compromised.
WHY THE LAST PART
Changing the password alone leaves a script that will resume.
WHAT TO CHECK
Recently modified files in that account.
HOW TO REMOVE QUEUED MESSAGES
The removal command, applied to matched identifiers.
WHAT TO DO BEFORE DELETING ANYTHING
Confirm what you are deleting.
WHAT TO MONITOR
Queue size, with an alert on growth.
