Commands to Manage Exim Mail Server

[LCwHostLtd]

We can easily manage Exim via command line. We can easily remove mailqueues, If any particular user sending large number of emails we can easily find that account and remove it.

All sent mails is registered in directory /var/spool/exim/msglog and all records have their own ID number which is the same as message ID. In directory /var/spool/exim/input all records are marked after their ID with mark -H (header) and -D (content of message). For every sent message Exim creates 3 files. We wil be working with mentioned directories. 

1. To get counted message in the queue:

exim -bpc

2. Print a listing of the messages in the queue (time queued, size, message-id, sender, recipient):

exim -bp

3. Print a summary of messages in the queue (count, volume, oldest, newest, domain, and totals):

exim -bp | exiqsumm

4. Print what Exim is doing right now:

exiwhat

5. Testing how e-mail address is pointed:

exim -bt mail@domain.com

6. Run a pretend SMTP transaction from the command line, as if it were coming from the given IP address. This will display Exim's checks, ACLs, and filters as they are applied. The message will NOT actually be delivered:

exim -bh XXX.XXX.XX.XX

7. Display all of Exim's configuration settings:

exim -bP

Searching the queue with exiqgrep

Exim includes a utility that is quite nice for grepping through the queue, called exiqgrep.

1. Use -f to search the queue for messages from a specific sender:

exiqgrep -f @domain

2. Use -r to search the queue for messages for a specific recipient/domain:

exiqgrep -r @domain

3. Use -o to print messages older than the specified number of seconds. For example, messages older than 1 day:

exiqgrep -o 86400 [...]

4. Use -y to print messages that are younger than the specified number of seconds. For example, messages less than an hour old:

exiqgrep -y 3600 [...]

5. Use -s to match the size of a message with a regex. For example, 700-799 bytes:

exiqgrep -s '^7..$' [...]

Use -z to match only frozen messages, or -x to match only unfrozen messages. There are also a few flags that control the display of the output.

6. Use -i to print just the message-id as a result of one of the above two searches:

exiqgrep -i [ -r | -f ] ...

7. Use -c to print a count of messages matching one of the above searches:

exiqgrep -c ...

8. Print just the message-id of the entire queue:

exiqgrep -i

Managing the queue

1. Start a queue run

exim -q -v

2. Start a queue run for just local deliveries:

exim -ql -v

3. Remove a message from the queue:

exim -Mrm <message-id> [ <message-id> ... ]

4. Freeze a message:

exim -Mf <message-id> [ <message-id> ... ]

5. Throw a message:

exim -Mt <message-id> [ <message-id> ... ]

6. Deliver a message, whether it's frozen or not, whether the retry time has been reached or not:

exim -M <message-id> [ <message-id> ... ]

7. Deliver a message, but only if the retry time has been reached:

exim -Mc <message-id> [ <message-id> ... ]

8. Force a message to fail and bounce as "cancelled by administrator":

exim -Mg <message-id> [ <message-id> ... ]

9. Remove all frozen messages:

exiqgrep -z -i | xargs exim -Mrm

10. Remove all messages older than five days (86400 * 5 = 432000 seconds):

exiqgrep -o 432000 -i | xargs exim -Mrm

11. Freeze all queued mail from a given sender:

exiqgrep -i -f luser@example.tld | xargs exim -Mf

12. View a message's headers:

exim -Mvh <message-id>

13. View a message's body:

exim -Mvb <message-id>

14. View a message's logs:

exim -Mvl <message-id>

Digging Into Exim Mail Logs With Exigrep

One single mail transaction will span multiple lines in the file, and not every line will have the search string you are looking for. The exigrep command works around this problem by finding your search string in transactions, and then helpfully gathering every log entry into separate, complete transactions.

1. Search for messages sent from a particular IP address:

exigrep '<= .* \[12.34.56.78\] ' /path/to/exim_log

2. search for messages sent to a particular IP address:

exigrep '=> .* \[12.34.56.78\] ' /path/to/exim_log

This is how you search for outgoing messages with the “=>” symbol that are sent to “mail@domain.com”. The pipe to grep for the “<=” symbol will only match lines containing information on the sender, the From address, the sender’s IP address, the message size, the message ID, and the subject line if you have enabled logging the subject.

3. Generate and display Exim stats from a logfile:

eximstats /path/to/exim_mainlog

4. Same as above, with less verbose output:

eximstats -ne -nr -nt /path/to/exim_mainlog

5.To delete all queued messages containing a certain string in the body:

grep -lr 'a certain string' /var/spool/exim/input/ | \sed -e 's/^.*\/\([a-zA-Z0-9-]*\)-[DH]$/\1/g' | xargs exim -Mrm

-- http://www.exim.org/
-- http://www.exim.org/docs.html