This is my exim usage
What makes it odd is that exim4 mail server service is STOPPED Also none of my sites is actually sending any emails. (This is on a VPS)
How I can find what is sending emails if any? And is it at all possible when this service is off? Can php send emails on it's own?
I'd guess that this is output from cron jobs.
Have you looked at what's in the Exim queue?
exim -bp
You can also use exim to look at the headers and bodies of the queued messages using queue ids from the above command's output ...
exim -Mvh 1Xy5Qg-0003xF-AH
exim -Mvb 1Xy5Qg-0003xF-AH
If exim -bp doesn't show anything, that implies that something else if leaving files in Exim's spool directory and confusing your stats.
Exim try to submit a message, receiving MTA decline submission, message is stored in the queue for later trials and that is why your queue is growing.
You have to investigate why does your messages are declined. Good starting point is the /var/spool/exim/msglog - each declined message have separate file here.
Your queue is growing as would be expected when you stop Exim. Usage seems to be quite low with a few messages at about 5 in the morning when cron often runs daily jobs. Usage is also heavy early in the evening.
Even if the service is stopped, it is commonly called by running the program and submitting the messages. Normally, this call would deliver the mail immediately, or queue the message for later delivery. This is likely what you are seeing. As messages are queueing, it is likely that the some (all) destinations can not be reached.
PHP and other languages have modules for sending emails. These usually default to using the local server. Normally, there are options that can be set to specify a different host to be used.
You can see where the mail is coming from by looking at Exim's log file. This is often /var/log/exim/mainlog. The details there should show where the messages are coming from, and to whom they were sent.
The command sudo mailq should show all the messages and who they have been sent too. There are options to display the headers and contents of messages in the queue. Look for the options beginning -Mv in the man page.
Normally, you want a mail server running, although you may not want it listening on any public addresses. crontab and other programs use email to send notifications to their users. The default configuration can be tuned anywhere from a local server with local delivery to a full fledged Internet MX.
