Sometimes when debugging SMTP issues the standard maillog is not enough and I need to see the full SMTP session. In postfix I add the problematic IP to "debug_peer_list" which will enable the session log and other debug information for only that IP.

Is there a similar thing in exim? I have only found references to "running exim in debug mode" which apparently causes ALL sessions to be logged which I fear will quickly write tons of unnecessary logs, cause heavy disk I/O, and make it hard to find the transaction in question

TL;DR: What is the best way to get a full SMTP transaction log from a specific IP (or sender address) ?

I'm running exim 4.80 (a cpanel server).

up vote 7 down vote accepted

You can easily look at the commands received from the remote system with a few ACL additions:

# Global hosts setting, list of IP addresses you want to see SMTP commands
hostlist debug_hosts = xxx.xxx.xxx.xxx : yyy.yyy.yyy.yyy

# early in acl_smtp_helo
warn hosts     = +debug_hosts
     log_write = DEBUG: $smtp_command

# early in acl_smtp_mail
warn hosts     = +debug_hosts
     log_write = DEBUG: $smtp_command

# early in acl_smtp_rcpt
warn hosts     = +debug_hosts
     log_write = DEBUG: $smtp_command

But if you want to see in the logs what your side is saying too, that's not possible inside exim. Your options are then constrained to any system provided network debugging tools, such as tcpdump, tshark, or (my favorite) ngrep.

As an example, if you have a customer who complains they cannot send mail through your server. Here's a simple entry that shows why they are unable to send:

# ngrep -q port 25 host 208.54.85.254
<snip>
T 208.54.85.254:15084 -> 208.89.138.22:25 [AP]
  AUTH PLAIN kkvdsoirDSAasdfrASDF4swSD23DAGAG6893Mgss==..                            

T 208.89.138.22:25 -> 208.54.85.254:15084 [AP]
  535 Incorrect authentication data..

I hope that one of these proves to be useful for you.

  • very informative, thanks! "not possible" is not the answer I was hoping for obviously, but having one side of the chat protocol is already something. I currently use network debuggers for this task, its just a PITA to dissect the TLS sessions, so I was looking for a simpler solution within the MTA – Gryphius Jan 1 '13 at 14:43
  • I am getting the following error , option "hostlist" unknown and exim start fails. – Mani Mar 11 '16 at 16:03
  • xxx.xxx.xxx.xxx : yyy.yyy.yyy.yyy ==> What are these ? Client or server IP address ? – Mani Mar 11 '16 at 16:04
  • 1
    This was a life saver cuz the documentation was not making it easy to find logging. As a note though, on my copy of Exim (4.89), it's logwrite, rathern than logwrite. Otherwise it exim fails to start (even though the service status says it's active and running, chuh). Alas, this still doesn't help me with my general logging level problem but, baby steps... – DaveJenni Feb 23 at 22:24

Possibly not what you're after, but wireshark / tshark is great for this. On the command line:

tshark -w exim.pcap -i <interface> host <target IP>

Then open the file in Wireshark and you can peruse the whole SMTP conversation at your leisure: Right-click on one matching packet and select 'View TCP Conversation'.

If you want to see it as it happens, just omit the -w argument from the above, though that can be pretty spammy with large emails.

  • thanks, that's my current workaround, but it's very cumbersome, especially when you have to deal with TLS sessions. I was hoping there is an easier way within exim. – Gryphius Dec 31 '12 at 15:09

I don't think I have the same problem as this but running the SMTP transaction yourself is a useful debug tool.

For example, if you're supposed to be receiving SMTP mail from host mysender.example.com, 93.184.216.34, with an address hosted by your MTA (postmaster@yoursmtp.com) to some foreign address (eg@example.com) it would look like this - type each line interactively, you'll see the output is pretty verbose:

exim -bhc 93.184.216.34
EHLO mysender.example.com
MAIL FROM:<postmaster@yoursmtp.com>
RCPT TO:<eg@example.com>
DATA
.

There are other options people might have to use depending on their set up but this is working for me. Happy to take corrections from people who speak SMTP/Exim more fluently though.

[Taken from https://github.com/Exim/exim/wiki/TroubleShooting]

The ACL debug control specifier can be useful for this, e.g. you could use the same approach as in the answer above but using

control = debug/opts=+all

instead of logwrite. Note that the output goes to debuglog file in the log directory by default, i.e. something like /var/log/exim4/debuglog.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.