Mail Logs
Overview
Section titled “Overview”Evidence: Mail Logs
Description: Collect Mail Logs
Category: System
Platform: linux
Short Name: maill
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Linux mail logs record email server activities including message delivery, SMTP transactions, mail relay operations, and email-related errors from services like Postfix, Sendmail, or Exim.
Data Collected
Section titled “Data Collected”This collector gathers structured data about mail logs.
Collection Method
Section titled “Collection Method”This collector gathers mail log files from /var/log/mail*, including rotated archives, which contain email server operational logs.
Forensic Value
Section titled “Forensic Value”Mail logs are essential for investigating email-based attacks, spam campaigns, phishing attempts, email exfiltration, and mail server compromise. They provide evidence of email communications and server abuse.