无法找到Saslauthd登录尝试的IP地址

Question

我需要帮助定位此错误消息/登录尝试中的原始IP：

通过Logwatch从'sasl auth守护进程‘：

pam_unix(smtp:auth): check pass; user unknown
pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= 
pam_succeed_if(smtp:auth): error retrieving information about user whatEver

来自/var/log/messages：

Mar  8 04:38:51 mySuperServer saslauthd[17397]: do_auth         : auth failure: [user= whatEver] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]

我知道这和saslauthd有关。他们试图连接到SMTP端口发送电子邮件，但被拒绝。我似乎在任何地方都找不到IP地址，我想阻止它。

Answer 1

SASLAUTHD的IP地址登录到/var/log/mail.log