EXIM:
Exim is an application which handles all outgoing emails (Outlook, Webmail, through any scripts). Exim scans all outgoing emails, make sure the email delivers to recipient and it will send logs for each emails and you can find it in Exim log for whole server or each user or mailbox.
Below are important Exim commands:
1. This command tells us the number of emails sent per account.
grep ‘<=.*user@domain.com’ /var/log/exim_mainlog | wc -l

Unfortunately, this command will give number of outgoing emails detail per day per domain name or account.

2. You can see the Exim current email queue by running command:
sudo exim -bp

The output looks something like:
——————————————————————
53h  5.4K 1Qogs5-0004N6-0J <> *** frozen ***
me@test.com
——————————————————————
Detail:
a. 53h= mail is in queue for 53 hours.
b. 5.4K = mail size including text/attachments.
c. 1Qogs5-000f4N6-0J message ID (its Unique ID).
d. <> *** frozen *** status of email.
e. To: which address:me@test.com

2.1:
How to check whether email in queue is spam?
Check email headers by running following command:
sudo exim -Mvh message ID (In my example: sudo exim -Mvh 1Qogs5-0004N6-0J)
Check email body content by running following command: sudo exim -Mvb message ID. (In my example: sudo exim -Mvb 1Qogs5-0004N6-0J)

What if I find a spammer?
You can de-activate Outgoing email server and then run sudo exiqgrep | grep -B1 <user> | grep -v “\-\-” | grep -o “\w*\-\w*\-\w*” | xargs -r exim -Mrm to remove all spam mails from queue.

DO NOT run this command if you don’t know what you are doing. Also, change <user> with original spam sender’s email address.
Example:
sudo exiqgrep | grep -B1 user@spammer-domain.com | grep -v “\-\-” | grep -o “\w*\-\w*\-\w*” | xargs -r exim Mrm

To see the number of emails in Exim queue run: sudo exim -bpc and to see list of all emails sudo exim -bp.

I am collecting much much more Exim commands and will be sending you an email within next couple weeks. Let me know if you have any questions! Also, forward me if you have any useful commands!


Comments are closed