KiraX
Established Member
- Impact
- 0
Hello everyone!
Could you please tell me if I'm understanding the analysis of mail logs on Exim-based servers correctly?
I use two main log files:
I see that Exim marks log entries with flags (<=, =>, **, ==, etc.) that indicate the delivery status. To view the full trace of a message, I first search for the mailbox I'm interested in, get the message ID (for example, 1kPNom-0007xj-FA), and then search by that ID to see its full path.
I've put together two examples — one successful and one unsuccessful — but I want to make sure I'm interpreting them correctly:
Does this logic look correct? Are there any other nuances I should pay attention to when reviewing Exim logs?
Could you please tell me if I'm understanding the analysis of mail logs on Exim-based servers correctly?
I use two main log files:
- /var/log/exim_mainlog — incoming and outgoing messages
- /var/log/maillog — IMAP/POP3 mailbox connections (handled by dovecot)
I see that Exim marks log entries with flags (<=, =>, **, ==, etc.) that indicate the delivery status. To view the full trace of a message, I first search for the mailbox I'm interested in, get the message ID (for example, 1kPNom-0007xj-FA), and then search by that ID to see its full path.
I've put together two examples — one successful and one unsuccessful — but I want to make sure I'm interpreting them correctly:
- Successful: the message arrived, was placed in the queue, and saved to the virtual mailbox.
- Unsuccessful: LMTP returns a defer due to quota or limit being exceeded.
Does this logic look correct? Are there any other nuances I should pay attention to when reviewing Exim logs?
