Find php spam script for cpanel/exim server

Edit php.ini and search for “mail.log”, check whether this option is enabled or not, if not uncomment it and specify log file name.

# nano /usr/local/lib/php.ini
mail.log = /var/log/phpmail.log

# touch /var/log/phpmail.log

File must be writable or owned by apache user.

# chmod 666 /var/log/phpmail.log
# chown apache.apache /var/log/phpmail.log

# service httpd restart

# tail -f /var/log/phpmail.log