Exim & Spamming

The following commands are very useful while troubleshooting the email issues :

To see total number of mails in the Queue :
exim -bpc

To Print all mails in the Queue :
exim -bp

To see the summary of all mails in the Queue :
exim -bp | exiqsumm

To see the messages from a particular user :
exiqgrep -f user@domain

 To see the route for a particular email address : exim -bt gopu@domain.com 
To see the mail content : exim -Mvb Mail_ID 
Remove all mails from the Queue for a particular user : exiqgrep -i -f user@domain.com | xargs exim -Mrm

Useful command : eximstats -ne -nr /var/log/exim_mainlog

To check the number of messages in the queue:
 #exim -bpc

 To check the listing of the messages in the queue (time queued, size, message id, sender, recipient):
 #exim -bp

 To check the summary of messages in the queue (count, volume, oldest, newest, domain, and total):
 #exim -bp| exiqsumm

To forcefully send all the mails :
exiqgrep -zi | xargs exim -M

 To check the current status of Exim:
 #exiwhat

 To search the queue for messages from a specific sender:
 #exigrep -f user@domainname.com

 To search the queue for a specific recipient:
 #exigrep -r user@domainname.com

 To print the message id of the entire queue:
 #exiqgrep -i

 To remove a message from the queue:
 #exim -Mrm <message id>

 To Freeze a message:
 #exim -Mf <message id>

 To forcefully deliver a message:
 #exim -M <message id>

 To force a message to Freeze and bounce as “Canceled by Admin” :
 #exim -Mg <message id>

 To remove all frozen mails:
 #exiqgrep -z -i | xargs exim -Mrm

 To freeze all queued mail for a given sender:
 #exiqgrep -i -f user@domain.com | xargs exim -Mf

 To view a message body:
 #exim -Mvb <message id>

*****************

Scripts to check spamming in Exim mail server 
1. To check the number of emails present in the queue:

# exim -bpc

2. To check the emails present in the queue with the mail id and sender ID:

# exim -bp
# exim -bp | less

3. To view the header of a particular email using mail ID:

# exim -MvH mail_id

4.  To view the body of a particular email using mail ID:

# exim -Mvb mail_id 

5. To view a message's logs:

# exim -Mvl mail_id

6. To trace path:

# exim -d -bt user@domain.com

7. To get sorted list of email sender in exim queue:

# exim -bpr | grep "<" | awk {'print $4'} |cut -d "<" -f 2 | cut -d ">" -f 1 | sort -n | uniq -c| sort -n

8. To check the script that will originate spam mails:

# grep "cwd=" /var/log/exim_mainlog|awk '{for(i=1;i<=10;i++){print $i}}'|sort| uniq -c|grep cwd|sort -n

9. If we need to find out exact spamming script. To do this, run following command:

# ps auxwwwe | grep user | grep --color=always "/home/user/public_html/templates/" | head

10.  To delete the emails of a specific user:

# grep -lr 'user@domain.com' /var/spool/exim/input/ | sed -e 's/^.*\/\([a-zA-Z0-9-]*\)-[DH]$/\1/g' | xargs exim -Mrm

# exim -bp | grep "user_email-account" | awk '{print $3}' | xargs exim -Mrm

11. To delete Frozen emails from the email queue:

# grep -R -l '*** Frozen' /var/spool/exim/msglog/*|cut -b26-|xargs exim -Mrm
# exim -bp| grep frozen | awk '{print $3}'| xargs exim -Mrm
# exiqgrep -z -i | xargs exim -Mrm 

12.  To delete Spam emails from the email queue:

#  grep -R -l [SPAM] /var/spool/exim/msglog/*|cut -b26-|xargs exim -Mrm

13. To check the no. of frozen mails:

# exiqgrep -z -c

14. To check exim logs:

# tail -f /var/log/exim_mainlog

15. Force delivery of one message:

# exim -M mail_id

16. Force another queue run:

# exim -qf

17. Force another queue run and attempt to flush frozen messages:

# exim –qff

18. Forcefully send emails for a particular domain :

#exim -v -Rff domain
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s