Lik`s forum

[lik]

exim -qff => flush exim queue
exim -M email-id => Force delivery of one message
exim -qf => Force another queue run
exim -qff => Force another queue run and attempt to flush the frozen message
exim -Mvl messageID => View the log for the message
exim -Mvb messageID => View the body of the message
exim -Mvh messageID => View the header of the message
exim -Mrm messageID => Remove message without sending any error message
exim -Mg messageID => Giveup and fail message to bounce the message to the Sender
exim -bpr | grep "<" | wc -l => How many mails on the Queue
exim -bpr | grep frozen | wc -l => How many Frozen mails on the queue
exim -bpr | grep frozen | awk {'print $3'} | xargs exim -Mrm => Deleteing Frozen Messages
exim -bpc => find out, how many mails are there in the mail queue
exim -bp => check the mails in the queue <== exiqgrep -- works faster
exim -bt email => trace message delivery
exim -bp| exiqsumm => summary of the email queue

Run a pretend SMTP transaction from the command line, as if it was trying to deliver email to the given address.
This will display Exim's checks, ACLs, and filters as they are applied. The message will NOT actually be delivered.

exim -d -bt [email protected]
exim -v -bt [email protected]

Run a pretend SMTP transaction from the command line, as if it were coming from the given IP address.
This will display Exim's checks, ACLs, and filters as they are applied. The message will NOT actually be delivered.
# exim -bh 192.168.11.22
Exim ACL example:
# Ignore messages from list mails
accept condition = ${if match_address{${address:$h_to:}}{lsearch;/etc/exim.mail_to_allow}{yes}{no}}


#!!# cPanel Exim 4 Config
...
domainlist remote_domains = lsearch;/etc/remotedomains ...

#section acl_local_send

...
# Ignore messages to remote_domains
accept condition = ${if
match_domain{${domain:${address:$h_to:}}}{+remote_domains}{yes}{no}}


При этом варианте можно отсылать почту через sendmail wrapper с лубого email
адресса в поле from, на домены что находятся в списке +remote_domains
Поле To: должно быть согласно RFC и содержать один email адресс.

Если нужно делать рассылку на несколько адрессов, то используйте следующую
схему (править ACL не надо), далалось для сайтов на Joomla, MX записи домена
на google.com:

Для того чтобы отсылать письма с почтовых форм от доменов MX записи которых
не принадлежат нашим серверам используйте следующую конструкцию:
1) создать сабдомен в домене который хостится на нашем сервере, например
сабдомен fwd.nedeca.org
2) добавить форвардинг адресс через интерфейс cpanel, например
[email protected] и на него добавить адресса которым будет
пересылатся почта с вашей веб формы (пожалуста создавайте сложный email
forwarding адресс, чтобы спамеры не узнали про него и не отсылали вам
ненужную кореспонденцию)
3) добавить созданый вами форвард адресс ([email protected]) в
интерфейсе joomla
4) все работает, все довольны

##########
exiwhat - list of active exim processes
exiqgrep - email queue grep alternative
exim -bpu - select undeliverable/ed emails from the queue

[lik]

delete messages older than X hours (X in seconds)

Code: Select all

/usr/sbin/exiqgrep -o X -i | /usr/bin/xargs exim -Mrm

[lik]

http://www.opennet.ru/base/net/exim_options.txt.html

[lik]

Specification of the Exim Mail Transfer Agent
http://www.lissyara.su/?id=1200

[lik]

http://linux.die.net/man/8/exim

Message-IDs and spool files

The message-IDs that Exim uses to refer to messages in its queue are mixed-case alpha-numeric, and take the form of: XXXXXX-YYYYYY-ZZ. Most commands related to managing the queue and logging use these message-ids.

There are three -- count 'em, THREE -- files for each message in the spool directory. If you're dealing with these files by hand, instead of using the appropriate exim commands as detailed below, make sure you get them all, and don't leave Exim with remnants of messages in the queue. I used to mess directly with these files when I first started running Exim machines, but thanks to the utilities described below, I haven't needed to do that in many months.

Files in /var/spool/exim/msglog contain logging information for each message and are named the same as the message-id.

Files in /var/spool/exim/input are named after the message-id, plus a suffix denoting whether it is the envelope header (-H) or message data (-D).

These directories may contain further hashed subdirectories to deal with larger mail queues, so don't expect everything to always appear directly in the top /var/spool/exim/input or /var/spool/exim/msglog directories; any searches or greps will need to be recursive. See if there is a proper way to do what you're doing before working directly on the spool files.

Basic information
Print what Exim is doing right now:

Code: Select all

exiwhat

Test how exim will route a given address:

Code: Select all

exim -bt [email protected]

[email protected]
    <-- [email protected]
  router = localuser, transport = local_delivery


Code: Select all

exim -bt [email protected]

[email protected]
  router = localuser, transport = local_delivery
root@localhost# exim -bt [email protected]
  router = lookuphost, transport = remote_smtp
  host mail.remotehost.com [1.2.3.4] MX=0

Run a pretend SMTP transaction from the command line, as if it were coming from the given IP address. This will display Exim's checks, ACLs, and filters as they are applied. The message will NOT actually be delivered.

Code: Select all

exim -bh 192.168.11.22

Display all of Exim's configuration settings:

Code: Select all

exim -bP

Searching the queue with exiqgrep

Exim includes a utility that is quite nice for grepping through the queue, called exiqgrep. Learn it. Know it. Live it. If you're not using this, and if you're not familiar with the various flags it uses, you're probably doing things the hard way, like piping `exim -bp` into awk, grep, cut, or `wc -l`. Don't make life harder than it already is.

First, various flags that control what messages are matched. These can be combined to come up with a very particular search.

Use -f to search the queue for messages from a specific sender:

Code: Select all

exiqgrep -f [luser]@domain

Use -r to search the queue for messages for a specific recipient/domain:

Code: Select all

exiqgrep -r [luser]@domain

Use -o to print messages older than the specified number of seconds. For example, messages older than 1 day:

Code: Select all

exiqgrep -o 86400 [...]

Use -y to print messages that are younger than the specified number of seconds. For example, messages less than an hour old:

Code: Select all

exiqgrep -y 3600 [...]

Use -s to match the size of a message with a regex. For example, 700-799 bytes:

Code: Select all

exiqgrep -s '^7..$' [...]

Use -z to match only frozen messages, or -x to match only unfrozen messages.
There are also a few flags that control the display of the output.
Use -i to print just the message-id as a result of one of the above two searches:

Code: Select all

exiqgrep -i [ -r | -f ] ...

Use -c to print a count of messages matching one of the above searches:

Code: Select all

exiqgrep -c ...

Print just the message-id of the entire queue:

Code: Select all

exiqgrep -i

Managing the queue

The main exim binary (/usr/sbin/exim) is used with various flags to make things happen to messages in the queue. Most of these require one or more message-IDs to be specified in the command line, which is where `exiqgrep -i` as described above really comes in handy.

Start a queue run:

Code: Select all

exim -q -v

Start a queue run for just local deliveries:

Code: Select all

exim -ql -v

Remove a message from the queue:

Code: Select all

exim -Mrm <message-id> [ <message-id> ... ]

Freeze a message:

Code: Select all

exim -Mf <message-id> [ <message-id> ... ]

Thaw a message:

Code: Select all

exim -Mt <message-id> [ <message-id> ... ]

Deliver a message, whether it's frozen or not, whether the retry time has been reached or not:

Code: Select all

exim -M <message-id> [ <message-id> ... ]

Deliver a message, but only if the retry time has been reached:

Code: Select all

exim -Mc <message-id> [ <message-id> ... ]

Force a message to fail and bounce as "cancelled by administrator":

Code: Select all

exim -Mg <message-id> [ <message-id> ... ]

Remove all frozen messages:

Code: Select all

exiqgrep -z -i | xargs exim -Mrm

Remove all messages older than five days (86400 * 5 = 432000 seconds):

Code: Select all

exiqgrep -o 432000 -i | xargs exim -Mrm

Freeze all queued mail from a given sender:

Code: Select all

exiqgrep -i -f [email protected] | xargs exim -Mf

View a message's headers:

Code: Select all

exim -Mvh <message-id>

View a message's body:

Code: Select all

exim -Mvb <message-id>

View a message's logs:

Code: Select all

exim -Mvl <message-id>

Add a recipient to a message:

Code: Select all

exim -Mar <message-id> <address> [ <address> ... ]

Edit the sender of a message:

Code: Select all

exim -Mes <message-id> <address>

Access control

Exim allows you to apply access control lists at various points of the SMTP transaction by specifying an ACL to use and defining its conditions in exim.conf. You could start with the HELO string.

# Specify the ACL to use after HELO
acl_smtp_helo = check_helo

# Conditions for the check_helo ACL:
check_helo:

deny message = Gave HELO/EHLO as "friend"
log_message = HELO/EHLO friend
condition = ${if eq {$sender_helo_name}{friend} {yes}{no}}

deny message = Gave HELO/EHLO as our IP address
log_message = HELO/EHLO our IP address
condition = ${if eq {$sender_helo_name}{$interface_address} {yes}{no}}

accept

NOTE: Pursue HELO checking at your own peril. The HELO is fairly unimportant in the grand scheme of SMTP these days, so don't put too much faith in whatever it contains. Some spam might seem to use a telltale HELO string, but you might be surprised at how many legitimate messages start off with a questionable HELO as well. Anyway, it's just as easy for a spammer to send a proper HELO than it is to send HELO im.a.spammer, so consider yourself lucky if you're able to stop much spam this way.

Next, you can perform a check on the sender address or remote host. This shows how to do that after the RCPT TO command; if you reject here, as opposed to rejecting after the MAIL FROM, you'll have better data to log, such as who the message was intended for.

# Specify the ACL to use after RCPT TO
acl_smtp_rcpt = check_recipient

# Conditions for the check_recipient ACL
check_recipient:

# [...]

drop hosts = /etc/exim_reject_hosts
drop senders = /etc/exim_reject_senders

# [ Probably a whole lot more... ]

This example uses two plain text files as blacklists. Add appropriate entries to these files - hostnames/IP addresses to /etc/exim_reject_hosts, addresses to /etc/exim_reject_senders, one entry per line.

It is also possible to perform content scanning using a regex against the body of a message, though obviously this can cause Exim to use more CPU than it otherwise would need to, especially on large messages.

# Specify the ACL to use after DATA
acl_smtp_data = check_message

# Conditions for the check_messages ACL
check_message:

deny message = "Sorry, Charlie: $regex_match_string"
regex = ^Subject:: .*Lower your self-esteem by becoming a sysadmin

accept

Log the subject line

This is one of the most useful configuration tweaks I've ever found for Exim. Add this to exim.conf, and you can log the subject lines of messages that pass through your server. This is great for troubleshooting, and for getting a very rough idea of what messages may be spam.

log_selector = +subject

Reducing or increasing what is logged.
Disable identd lookups

Frankly, I don't think identd has been useful for a long time, if ever. Identd relies on the connecting host to confirm the identity (system UID) of the remote user who owns the process that is making the network connection. This may be of some use in the world of shell accounts and IRC users, but it really has no place on a high-volume SMTP server, where the UID is often simply "mail" or whatever the remote MTA runs as, which is useless to know. It's overhead, and results in nothing but delays while the identd query is refused or times out. You can stop your Exim server from making these queries by setting the timeout to zero seconds in exim.conf:

rfc1413_query_timeout = 0s

Disable Attachment Blocking

To disable the executable-attachment blocking that many Cpanel servers do by default but don't provide any controls for on a per-domain basis, add the following block to the beginning of the /etc/antivirus.exim file:

if $header_to: matches "example\.com|example2\.com"
then
finish
endif

It is probably possible to use a separate file to list these domains, but I haven't had to do this enough times to warrant setting such a thing up.
Searching the logs with exigrep

The exigrep utility (not to be confused with exiqgrep) is used to search an exim log for a string or pattern. It will print all log entries with the same internal message-id as those that matched the pattern, which is very handy since any message will take up at least three lines in the log. exigrep will search the entire content of a log entry, not just particular fields.

One can search for messages sent from a particular IP address:

root@localhost# exigrep '<= .* \[12.34.56.78\] ' /path/to/exim_log

Search for messages sent to a particular IP address:

root@localhost# exigrep '=> .* \[12.34.56.78\]' /path/to/exim_log

This example searches for outgoing messages, which have the "=>" symbol, sent to "[email protected]". The pipe to grep for the "<=" symbol will match only the lines with information on the sender - the From address, the sender's IP address, the message size, the message ID, and the subject line if you have enabled logging the subject. The purpose of doing such a search is that the desired information is not on the same log line as the string being searched for.

root@localhost# exigrep '=> .*[email protected]' /path/to/exim_log | fgrep '<='

Generate and display Exim stats from a logfile:

Code: Select all

eximstats /path/to/exim_mainlog

Same as above, with less verbose output:

Code: Select all

eximstats -ne -nr -nt /path/to/exim_mainlog

Same as above, for one particular day:

Code: Select all

fgrep YYYY-MM-DD /path/to/exim_mainlog | eximstats

To delete all queued messages containing a certain string in the body:

Code: Select all

grep -lr 'a certain string' /var/spool/exim/input/ | \
                sed -e 's/^.*\/\([a-zA-Z0-9-]*\)-[DH]$/\1/g' | xargs exim -Mrm

Note that the above only delves into /var/spool/exim in order to grep for queue files with the given string, and that's just because exiqgrep doesn't have a feature to grep the actual bodies of messages. If you are deleting these files directly, YOU ARE DOING IT WRONG! Use the appropriate exim command to properly deal with the queue.

Reload the configuration

After making changes to exim.conf, you need to give the main exim pid a SIGHUP to re-exec it and have the configuration re-read. Sure, you could stop and start the service, but that's overkill and causes a few seconds of unnecessary downtime. Just do this:

Code: Select all

kill -HUP `cat /var/spool/exim/exim-daemon.pid`