Useful Exim Commands

Uncategorized / May 12, 2021 / ashishpsk / 0

exigrep domain.com /var/log/exim_mainlog
cat /home/username/.contactemail
exim -bpc

List the messages in the queue:
exim -bop

List frozen mais:
exit -bp | grep frozen | wc -l

Summary of messages in the queue (count, volume, oldest, newest, domain, and totals):
exim -bp | exiqsumm

Display what Exim is doing right now:
exiwhat

Test Exim SMTP transaction
exim -bh ipaddress 

Display Exim settings

exim -bP

Remove emails sent from domain.com:

exiqgrep -i -f domain.com | xargs exim -Mrm

Remove emails sent to domain.com:

exiqgrep -ir domain.com | xargs exim -Mrm

Number of emails per email account:

exim -bpr | grep “<” | awk {‘print $4’} | cut -d “<” -f 2 | cut -d “>” -f 1 | sort -n | uniq -c | sort -n

Check the exim log for emails generated from folders/scripts (cwd):

grep "cwd=/home" /var/log/exim_mainlog | grep -v Cron | awk '{for(i=1;i<=10;i++){print $i}}' | sort | uniq -c | grep cwd | sort -n

awk '{ if ($0 ~ "cwd" && $0 ~ "home") {print $3} }' /var/log/exim_mainlog | sort | uniq -c | sort -nk 1

grep 'cwd=/home' /var/log/exim_mainlog | awk '{print $3}' | cut -d / -f 3 | sort -bg | uniq -c | sort -bg

Find any emails generated by a PHP script currently in the mail queue:

egrep -R "X-PHP-Script"  /var/spool/exim/input/*

IPs connected on port 25 – this is not particularly an exim command but it is useful for troubleshooting email problems:

netstat -plan | grep :25 | awk {'print $5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1

Find all messages sent as “Nobody”:

ps -C exim -fH ewww | awk '{for(i=1;i<=40;i++){print $i}}' | sort | uniq -c | grep PWD | sort -n

Mail queue summary:

exim -bpr | exiqsumm -c | head

Shows messages headers:

exim -Mvh messageid

Body of the message:

exim -Mvb message id 

Ref:
https://forums.cpanel.net/threads/notification-if-mail-queue-manager-pass-100-emails.253681/
https://serverfault.com/questions/401864/protecting-exim-queue-from-spammers-and-hogging-system-resources

This command will show you the directory path if any domain is sending the mails through scripts:

awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr

https://syslint.com/blog/tutorial/how-to-track-the-exim-email-spam-in-cpanel-server/