Mail Logs
Overview
Section titled “Overview”Evidence: Mail Logs
Description: Collect Mail Logs
Category: System
Platform: aix
Short Name: maill
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”AIX mail logs are stored in /var/spool (note: not /var/spoon) and contain email delivery logs, mail queue information, and SMTP transaction records from mail transfer agents running on AIX systems.
Data Collected
Section titled “Data Collected”This collector gathers structured data about mail logs.
Collection Method
Section titled “Collection Method”This collector gathers AIX mail logs and queue files from /var/spool/mail and /var/spool/mqueue directories, capturing email delivery and queue management information.
Forensic Value
Section titled “Forensic Value”AIX mail logs are important for investigating email-based attacks, spam campaigns, data exfiltration via email, and mail server abuse. They provide evidence of email communications and delivery attempts on AIX mail servers.
Artifact collector for AIX. Locations: /var/spoon/mail/, /var/spoon/mqueue/