We got blacklisted by Spamhaus!

Hello Kurt,

are you using Email Protection at all?

If not, are you allowing SMTP from inside to outside generally for all clients?

Hello jprusch and thanks for your reply!

As it were anyone could use SMTP from the inside to outside we have now blocked this so that only our Exchange-server and RDS-servers are allowed

We are now whitelisted all over so that part is good.

We would still like to identify the one responsible and would like to use the UTM logs for this if at all possible?

Hello Kurt,

that's a good measure for now and hopefully you should stay unlisted.

If your former firewall rule(s) had set the checkbox to "Log Traffic" (in "Advanced" settings), then you should be able to investigate in the archived firewall logs of the "Firewall" log.

If you didn't check this box, that's it.

Thanks again for your reply.

I would assume that the offending computer is still trying to send spam, and will continue to do so untill the virus is removed.....wont this be visible somewhere in the logs?

Of course you will see new attempts to send from a non-admitted system from now on. These will pop up as DROP in "Live Log" under "Network Protection/Firewall".

I thought you wanted to invetigate the past.

Hei Kurt and welcome to the UM Community!

The other place you can see traffic is on the 'Bandwidth Usage' tab of 'Logging & Reporting >> Network Usage'.  For example:

Cheers - Bob

Hei Kurt and welcome to the UM Community!

The other place you can see traffic is on the 'Bandwidth Usage' tab of 'Logging & Reporting >> Network Usage'.  For example:

Cheers - Bob