Re: Hunting email origins

["Chris Gaeden" <Chris.Gaeden@xxxxxxxxxx>]

Hi Rob,
WRKACTJOB SBS(QSYSWRK) JOB(QTSMTP*) shows no jobs, and TRCTCPAPP APP(*SMTPCLT) produces no spool files. If I can't get more details from our mail admin, I may have to break out Wireshark and sniff the traffic coming off the system.
 
Thanks for the tips!
Chris Gaeden
 

date: Thu, 3 Nov 2011 14:41:24 -0400
from: rob@xxxxxxxxx 
subject: Re: Hunting email origins
 
So you're saying that if you run
WRKACTJOB SBS(QSYSWRK) JOB(QTSMTP*)
you see no jobs?  If you do see any jobs then your system just might be 
running some of the SMTP services.  And, if so, you may be able to find 
the job with the steps in
http://publib.boulder.ibm.com/infocenter/iseries/v7r1m0/topic/rzair/rzairfixemail.htm 
The journals would be the easiest to nail down the job.
 
There's also
TRCTCPAPP APP(*SMTPCLT)
send an email
TRCTCPAPP APP(*SMTPCLT) SET(*OFF)
WRKJOB
4. Work with spooled files
Really useful, except in your case - won't show you the job involved.
 
Tried the comm trace.  It also doesn't tell you the job.  Sample data:
 Record       Data    Record           Controller  Destination   Source   
Frame            Number  Number    Poll/ 
 Number  S/R  Length  Timer            Name        MAC Address   MAC 
Address   Format  Command  Sent    Received  Final  DSAP  SSA
 ------  ---  ------  ---------------  ----------  ------------ 
------------  ------  -------  ------  --------  -----  ----  ---
    255   S       60  14:34:50.276607              00070E347AFF 
020037440000   ETHV2   Type: 0800 
                      Frame Type :  IP          DSCP: 0   ECN: 00-NECT 
Length:    60   Protocol: TCP         Datagram ID: 02A0 
                                    Src Addr: 10.17.6.129         Dest 
Addr: 208.87.182.6        Fragment Flags: DON'T,LAST 
                      IP Header  : 
4500003C02A04000400600000A110681D057B606  
                      IP Options :  NONE   
                      TCP  . . . :  Src Port: 42732,Unassigned    Dest 
Port:    25,SMTP 
                                    SEQ Number:  2593156291 ('9A906CC3'X) 
ACK Number:          0 ('00000000'X) 
                                    Code Bits: SYN Window:  8192  TCP 
Option: MSS= 1452 
                      TCP Header : 
A6EC00199A906CC300000000A002200000000000020405AC010303000101080A8683E7CC00000000 
 
    256   R       60  14:34:50.277208              020037440000 
00070E347AFF   ETHV2   Type: 0800 
                      Frame Type :  IP          DSCP: 0   ECN: 00-NECT 
Length:    60   Protocol: TCP         Datagram ID: F41B 
                                    Src Addr: 208.87.182.6        Dest 
Addr: 10.17.6.129         Fragment Flags: DON'T,LAST 
                      IP Header  : 
4500003CF41B40003F06B0B0D057B6060A110681  
                      IP Options :  NONE   
 
As far as a performance killer, I don't think it has any impact.
 

Rob Berendt