How to read Exim mail logs on the server?

LitaR · Nov 20, 2025

Hello everyone!
Could you please tell me if I'm understanding the analysis of mail logs on Exim-based servers correctly?
I use two main log files:

/var/log/exim_mainlog — incoming and outgoing messages
/var/log/maillog — IMAP/POP3 mailbox connections (handled by dovecot)

I see that Exim marks log entries with flags (<=, =>, **, ==, etc.) that indicate the delivery status. To view the full trace of a message, I first search for the mailbox I'm interested in, get the message ID (for example, 1kPNom-0007xj-FA), and then search by that ID to see its full path.
I've put together two examples — one successful and one unsuccessful — but I want to make sure I'm interpreting them correctly:

Successful: the message arrived, was placed in the queue, and saved to the virtual mailbox.
Unsuccessful: LMTP returns a defer due to quota or limit being exceeded.

Does this logic look correct? Are there any other nuances I should pay attention to when reviewing Exim logs?

anjalischmitt · Nov 25, 2025

In my case i usually check /var/log/exim_mainlog and use grep to search for specific email addresses or errors. Works fine most of the time but i am still learning how to read bounce messages properly.

ITivan80 · Nov 27, 2025

Reading Exim mail logs on a Linux server (cPanel, WHM, or standard Exim installation) is straightforward once you know where the logs are stored and how to filter them.

TheCompWiz · 2026-08-02T07:42:19+0100

Your reading is right. The flags are the fastest way in: <= is the message being accepted into the queue, => is a successful delivery, -> is an extra recipient delivered over the same connection, == is a temporary defer that will be retried, and ** is a permanent failure that generates a bounce.

Two files that get forgotten are /var/log/exim_rejectlog and /var/log/exim_paniclog. Anything refused at SMTP time lands in rejectlog and never gets a message ID at all, so it will never show up in mainlog the way you are expecting. Paniclog should normally be empty, and anything in it is a config or permissions problem on your side rather than a mail problem. Have you tried exim -Mvl on a single message ID? It pulls just that message's lines without grepping the whole file.

How to read Exim mail logs on the server?

LitaR

New member

anjalischmitt

New member

TheCompWiz

Well-known member

ITivan80

Well-known member

TheCompWiz

Well-known member

Latest posts New threads

Latest posts

New threads

Latest Hosting Offers New Reviews

Latest hosting offers

Latest Reviews

Popular Contributors - Past 30 Days

Sponsors

Tag Cloud