RE: Hunting email origins

["Graap, Kenneth" <Kenneth.Graap@xxxxxxxxxxxxx>]

Maybe you could get the information you are looking for from the e-mail journal:

Here is an example of the data that's available...

ID 06FBEB51111041502410000004498 QPADEV0057 L3H        738233 QZMFSLOG                                   
               Date     Time     Data                                    Comment             
               11/04/11 15:02:41 E EH SNDMAIL TO MSF                                                    
                        15:02:41 E E1 O L3H@xxxxxxxxxxxxx                                               
                        15:02:41 E E2 R wsmilne@xxxxxxxxxxx                                             
                        15:02:41 E EX /tmp/E738233111104150241280.txt                                   
                        15:02:41 E ET MSG SIZE 1113                                                     
                        15:02:41 1                                       MSF message create  
                        15:02:41 P P2 R SMTP MsgFwd wsmilne@xxxxxxxxxxx                                 
                        15:02:41 C C6 FWD TO QTMSOUTQ                                                   
                        15:02:41 C C1 O L3H@xxxxxxxxxxxxx                                               
                        15:02:41 C C2 R <wsmilne@xxxxxxxxxxx>                                           
                        15:02:41 8 8B QTMSOUTQ TO CLNT                                                  
                        15:02:41 2 000010000100000                                                      
                        15:02:41 8 88 DLVED 172.17.0.181                 Successful delivery 
                        15:02:41 8 82 R <wsmilne@xxxxxxxxxxx>                                           
               * * * * *  E n d   O f   L i s t i n g  * * * * *  

Log codes consist of 2 characters. The first idenifies the the OS/400 function that generated the entry. 
 The second character identifies the action taken. The list of functions is:                              
    Id  Function Description                                                                              
     1  MSF message create                                                                                
     2  MSF message summary                                                                               
     3  MSF message reset by STRMSF MSGOPT(*RESET)                                                        
     4  MSF message removed by STRMSF MS                                                                  
     5  MSF message acted on by address switcher                                                          
     7  Bridge server processor for inbound SMTP queue                                                    
     8  SMTP client processor for outgoing mail                                                           
     9  SMTP server processor for incoming mail                                                           
     A  MSF non delivery processor                                                                        
     B  MSF local delivery processor                                                                      
     C  MSF message forwarding processor                                                                  
     D  POP create message                                                                                
     E  Send mail api                                                                                     
     F  Domino MTA                                                                                        
     G  Tunneling snap-in                                                                                 
     H  SNADS switcher 
     I  MIME parser (local delivery snap-in)          
     L  FAX (local delivery)                          
     M  SNADS                                         
     O  Filtering                                     
     P  MSF SMTP address resolution exit 
             
 The list of actions is:                              
    Id  Action Description                            
     1  Log origninator name                          
     2  Log recipient name                            
     3  Log undeliverable recipient                   
     4  Received mail from IPADDR (from host)         
     5  Received relayed mail IPADDR                  
     6  Move mail to outbound SMTP queue              
     7  Move mail to inbound SMTP queue               
     8  Delivered to IPADDR (of host)                 
     9  MSGID: <internal 822 Msg Id>                  
     A  Dequeue mail from inbound SMTP queue          
     B  Dequeue mail from outbound SMTP queue         
     C  Move mail to 1st retry queue after time out
     D  Move mail to 2nd retry queue after time out           
     E  Move mail from 1st retry queue to outbound SMTP queue 
     F  Move mail from 2nd retry queue to outbound SMTP queue 
     G  MSGID MAP TO < MSF ID >                               
     H  Move mail to MSF for processing                       
     K  Error resolving domain name: errno domain             
     L  PGMNAME TO QTMSBSSQ                                   
     M  QTMMBSSQ TO PGMNAME                                   
     N  PGMNAME TO QMSFQUEUE                                  
     O  Transfer mail to SNADS                                
     P  Undeliverable Notice                                  
     Q  Local Delivery By Tunneling                           
     R  Create Confirmation Of Delivery Message               
     S  Refuse spam connection: IPADDR                        
     T  Log message size                                      
     V  Refuse relay: IPADDR                                  
     W  Rejected by filtering                                 
     X  Remove original file containing message                                                                                                                                         

Kenneth
Kenneth E. Graap
http://www.linkedin.com/in/kennethgraap
 
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Friday, November 04, 2011 9:57 AM
To: Midrange Systems Technical Discussion
Subject: Re: Hunting email origins

There are some options in NETSTAT *CNN to see some stuff.  However, if you want to catch it in the act you may wish to look at the APIs to see if you can find one you can loop through that will find what job opens that port. 
 There's no STRWCH for port activity that I noticed.
http://publib.boulder.ibm.com/infocenter/iseries/v7r1m0/topic/apiref/api.htm


Rob Berendt
--
Group Dekko
Dept 1600
Mail to:  2505 Dekko Drive
          Garrett, IN 46738
Ship to:  Dock 108
          6928N 400E
          Kendallville, IN 46755
http://www.dekko.com





From:   "Chris Gaeden" <Chris.Gaeden@xxxxxxxxxx>
To:     <midrange-l@xxxxxxxxxxxx>, 
Date:   11/04/2011 12:34 PM
Subject:        Re: Hunting email origins
Sent by:        midrange-l-bounces@xxxxxxxxxxxx



Hi Pete,
 
I did try that, but every thing happens so fast with the email 
transactions that by the time it shows up in the list, the connection is 
already in the Time-wait state. Attempting to display the job associated 
with the connection in this state inevitably results in a screen telling 
me that there are no jobs for the connection. 
 
Displaying the details of the connection does show the associated user 
profile, but it's a service account on the system associated with over 300 
jobs.


 
 
Chris Gaeden
Systems Engineer
Jackson Family Enterprises
> > > <midrange-l-request@xxxxxxxxxxxx> 2011/11/04 08:31 >>>
date: Thu, 03 Nov 2011 23:24:53 -0600
from: Pete Helgren <pete@xxxxxxxxxx>
subject: Re: Hunting email origins

Couldn't you run netstat *cnn and find the listening port (25) and see 
what job that is?  Just a guess.

Pete Helgren
Value Added Software, Inc
www.petesworkshop.com 
GIAC Secure Software Programmer-Java