RE: Hunting email origins -- MIDRANGE-L

Maybe you could get the information you are looking for from the e-mail journal:

Here is an example of the data that's available...

ID 06FBEB51111041502410000004498 QPADEV0057 L3H 738233 QZMFSLOG
Date Time Data Comment
11/04/11 15:02:41 E EH SNDMAIL TO MSF
15:02:41 E E1 O L3H@xxxxxxxxxxxxx
15:02:41 E E2 R wsmilne@xxxxxxxxxxx
15:02:41 E EX /tmp/E738233111104150241280.txt
15:02:41 E ET MSG SIZE 1113
15:02:41 1 MSF message create
15:02:41 P P2 R SMTP MsgFwd wsmilne@xxxxxxxxxxx
15:02:41 C C6 FWD TO QTMSOUTQ
15:02:41 C C1 O L3H@xxxxxxxxxxxxx
15:02:41 C C2 R <wsmilne@xxxxxxxxxxx>
15:02:41 8 8B QTMSOUTQ TO CLNT
15:02:41 2 000010000100000
15:02:41 8 88 DLVED 172.17.0.181 Successful delivery
15:02:41 8 82 R <wsmilne@xxxxxxxxxxx>
* * * * * E n d O f L i s t i n g * * * * *

Log codes consist of 2 characters. The first idenifies the the OS/400 function that generated the entry.
The second character identifies the action taken. The list of functions is:
Id Function Description
1 MSF message create
2 MSF message summary
3 MSF message reset by STRMSF MSGOPT(*RESET)
4 MSF message removed by STRMSF MS
5 MSF message acted on by address switcher
7 Bridge server processor for inbound SMTP queue
8 SMTP client processor for outgoing mail
9 SMTP server processor for incoming mail
A MSF non delivery processor
B MSF local delivery processor
C MSF message forwarding processor
D POP create message
E Send mail api
F Domino MTA
G Tunneling snap-in
H SNADS switcher
I MIME parser (local delivery snap-in)
L FAX (local delivery)
M SNADS
O Filtering
P MSF SMTP address resolution exit

The list of actions is:
Id Action Description
1 Log origninator name
2 Log recipient name
3 Log undeliverable recipient
4 Received mail from IPADDR (from host)
5 Received relayed mail IPADDR
6 Move mail to outbound SMTP queue
7 Move mail to inbound SMTP queue
8 Delivered to IPADDR (of host)
9 MSGID: <internal 822 Msg Id>
A Dequeue mail from inbound SMTP queue
B Dequeue mail from outbound SMTP queue
C Move mail to 1st retry queue after time out
D Move mail to 2nd retry queue after time out
E Move mail from 1st retry queue to outbound SMTP queue
F Move mail from 2nd retry queue to outbound SMTP queue
G MSGID MAP TO < MSF ID >
H Move mail to MSF for processing
K Error resolving domain name: errno domain
L PGMNAME TO QTMSBSSQ
M QTMMBSSQ TO PGMNAME
N PGMNAME TO QMSFQUEUE
O Transfer mail to SNADS
P Undeliverable Notice
Q Local Delivery By Tunneling
R Create Confirmation Of Delivery Message
S Refuse spam connection: IPADDR
T Log message size
V Refuse relay: IPADDR
W Rejected by filtering
X Remove original file containing message

Kenneth
Kenneth E. Graap
http://www.linkedin.com/in/kennethgraap

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Friday, November 04, 2011 9:57 AM
To: Midrange Systems Technical Discussion
Subject: Re: Hunting email origins

There are some options in NETSTAT *CNN to see some stuff. However, if you want to catch it in the act you may wish to look at the APIs to see if you can find one you can loop through that will find what job opens that port.
There's no STRWCH for port activity that I noticed.
http://publib.boulder.ibm.com/infocenter/iseries/v7r1m0/topic/apiref/api.htm

Rob Berendt
--
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

From: "Chris Gaeden" <Chris.Gaeden@xxxxxxxxxx>
To: <midrange-l@xxxxxxxxxxxx>,
Date: 11/04/2011 12:34 PM
Subject: Re: Hunting email origins
Sent by: midrange-l-bounces@xxxxxxxxxxxx

Hi Pete,

I did try that, but every thing happens so fast with the email
transactions that by the time it shows up in the list, the connection is
already in the Time-wait state. Attempting to display the job associated
with the connection in this state inevitably results in a screen telling
me that there are no jobs for the connection.

Displaying the details of the connection does show the associated user
profile, but it's a service account on the system associated with over 300
jobs.

Chris Gaeden
Systems Engineer
Jackson Family Enterprises

<midrange-l-request@xxxxxxxxxxxx> 2011/11/04 08:31 >>>

date: Thu, 03 Nov 2011 23:24:53 -0600
from: Pete Helgren <pete@xxxxxxxxxx>
subject: Re: Hunting email origins

Couldn't you run netstat *cnn and find the listening port (25) and see
what job that is? Just a guess.

Pete Helgren
Value Added Software, Inc
www.petesworkshop.com
GIAC Secure Software Programmer-Java