Extended Exim Logging

How to Extend Exim Logging

About Exim
Exim is a message transfer agent (MTA) developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal of flexibility in the way mail can be routed, and there are extensive facilities for checking incoming mail. Exim can be installed in place of sendmail, although the configuration of exim is quite different to that of sendmail.
www.exim.org

Requirements
For this tutorial you will need root SSH access to your server. You will also need to be running Exim 4x MTA.
This works excellent with Cpanel machines!

What does this do?
What this addition does is it ads valuable logging information to your exim_mainlog file so that you can determine where messages are coming from, whos sending the message and from what directory on your server the user NOBODY is originating from, if your seeing mail leaving as nobody. In addition, it adds very useful information to exim_mainlog to help you decipher email coming and going.

Here is an example;

2003-06-27 14:06:18 cwd=/home/usersite/public_html/forums 3 args: /usr/sbin/sendmail -t -i
2003-06-27 14:06:18 19W0QE-0001Nr-1b nobody@yourserversname.com from env-from rewritten as ""usersite.com" <minx@usersite.com>" by rule 1

The message above tells me where the message came from, who sent it from my server, the user and the path it was called from. It also tells me how it was called and what it was renamed to before leaving my server.

The message below, tells me an incoming msg arrived with the subject line = "Naked Newsreaders? OH YEAH!". Very helpful in determining spam!!!!! You will see many other messages in exim_mainlog that you didnt see before. Great for debugging your msg logs and catching spammers!!

EG: 19W0bO-0001cY-Ej <= jessica@stripdownnews.com H=(one) [128.121.247.84]:52087 I=[64.246.38.122]:25 P=smtp S=2387 T="Naked Newsreaders? OH YEAH!" from jessica@stripdownnews.com

Lets Begin!
Note to MailScanner users: you must also do this to exim_config, so repeat these steps for both: exim.conf and exim_outgoing.conf

1. Open exim.conf
pico /etc/exim.conf

2) Find this;
Ctrl + W: hostlist auth_relay_hosts = *

#########################
Runtime configuration file for Exim #
#########################

3) After hostlist auth_relay_hosts = *

add the following

log_selector =
+address_rewrite
+all_parents
+arguments
+connection_reject
+delay_delivery
+delivery_size
+dnslist_defer
+incoming_interface
+incoming_port
+lost_incoming_connection
+queue_run
+received_sender
+received_recipients
+retry_defer
+sender_on_delivery
+size_reject
+skip_delivery
+smtp_confirmation
+smtp_connection
+smtp_protocol_error
+smtp_syntax_error
+subject
+tls_cipher
+tls_peerdn

4) The final result should look like this

hostlist auth_relay_hosts = *

log_selector =
+address_rewrite
+all_parents
+arguments
+connection_reject
+delay_delivery
+delivery_size
+dnslist_defer
+incoming_interface
+incoming_port
+lost_incoming_connection
+queue_run
+received_sender
+received_recipients
+retry_defer
+sender_on_delivery
+size_reject
+skip_delivery
+smtp_confirmation
+smtp_connection
+smtp_protocol_error
+smtp_syntax_error
+subject
+tls_cipher
+tls_peerdn

##################################################
####################
# Runtime configuration file for Exim #
##################################################
####################