<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html401/loose.dtd">
<html>
<!-- Created on September, 10 2009 by texi2html 1.78 -->
<!--
Written by: Lionel Cons <Lionel.Cons@cern.ch> (original author)
Karl Berry <karl@freefriends.org>
Olaf Bachmann <obachman@mathematik.uni-kl.de>
and many others.
Maintained by: Many creative people.
Send bugs and suggestions to <texi2html-bug@nongnu.org>
-->
<head>
<title>Specification of the Exim Mail Transfer Agent: 49. Log files</title>
<meta name="description" content="Specification of the Exim Mail Transfer Agent: 49. Log files">
<meta name="keywords" content="Specification of the Exim Mail Transfer Agent: 49. Log files">
<meta name="resource-type" content="document">
<meta name="distribution" content="global">
<meta name="Generator" content="texi2html 1.78">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css">
<!--
a.summary-letter {text-decoration: none}
pre.display {font-family: serif}
pre.format {font-family: serif}
pre.menu-comment {font-family: serif}
pre.menu-preformatted {font-family: serif}
pre.smalldisplay {font-family: serif; font-size: smaller}
pre.smallexample {font-size: smaller}
pre.smallformat {font-family: serif; font-size: smaller}
pre.smalllisp {font-size: smaller}
span.roman {font-family:serif; font-weight:normal;}
span.sansserif {font-family:sans-serif; font-weight:normal;}
ul.toc {list-style: none}
-->
</style>
</head>
<body lang="en" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#800080" alink="#FF0000">
<a name="Log-files"></a>
<a name="SEC435"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="spec_48.html#SEC434" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC436" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec_48.html#SEC434" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h1 class="chapter"> 49. Log files </h1>
<p>Exim writes three different logs, referred to as the main log, the reject log,
and the panic log:
</p>
<ul class="toc">
<li>
<a name="IDX2745"></a>
The main log records the arrival of each message and each delivery in a single
line in each case. The format is as compact as possible, in an attempt to keep
down the size of log files. Two-character flag sequences make it easy to pick
out these lines. A number of other events are recorded in the main log. Some of
them are optional, in which case the <code>log_selector</code> option controls whether
they are included or not. A Perl script called <em>eximstats</em>, which does simple
analysis of main log files, is provided in the Exim distribution (see section
<a href="spec_50.html#SEC459">Mail statistics (eximstats)</a>).
</li><li>
<a name="IDX2746"></a>
The reject log records information from messages that are rejected as a result
of a configuration option (that is, for policy reasons).
The first line of each rejection is a copy of the line that is also written to
the main log. Then, if the message's header has been read at the time the log
is written, its contents are written to this log. Only the original header
lines are available; header lines added by ACLs are not logged. You can use the
reject log to check that your policy controls are working correctly; on a busy
host this may be easier than scanning the main log for rejection messages. You
can suppress the writing of the reject log by setting <code>write_rejectlog</code>
false.
</li><li>
<a name="IDX2747"></a>
<a name="IDX2748"></a>
When certain serious errors occur, Exim writes entries to its panic log. If the
error is sufficiently disastrous, Exim bombs out afterwards. Panic log entries
are usually written to the main log as well, but can get lost amid the mass of
other entries. The panic log should be empty under normal circumstances. It is
therefore a good idea to check it (or to have a <em>cron</em> script check it)
regularly, in order to become aware of any problems. When Exim cannot open its
panic log, it tries as a last resort to write to the system log (syslog). This
is opened with LOG_PID+LOG_CONS and the facility code of LOG_MAIL. The
message itself is written at priority LOG_CRIT.
</li></ul>
<p>Every log line starts with a timestamp, in the format shown in the following
example. Note that many of the examples shown in this chapter are line-wrapped.
In the log file, this would be all on one line:
</p>
<table><tr><td> </td><td><pre class="example">2001-09-16 16:09:47 SMTP connection from [127.0.0.1] closed
by QUIT
</pre></td></tr></table>
<p>By default, the timestamps are in the local timezone. There are two
ways of changing this:
</p>
<ul class="toc">
<li>
You can set the <code>timezone</code> option to a different time zone; in particular, if
you set
<table><tr><td> </td><td><pre class="example">timezone = UTC
</pre></td></tr></table>
<p>the timestamps will be in UTC (aka GMT).
</p>
</li><li>
If you set <code>log_timezone</code> true, the time zone is added to the timestamp, for
example:
<table><tr><td> </td><td><pre class="example">2003-04-25 11:17:07 +0100 Start queue run: pid=12762
</pre></td></tr></table>
</li></ul>
<a name="IDX2749"></a>
<a name="IDX2750"></a>
<p>Exim does not include its process id in log lines by default, but you can
request that it does so by specifying the ‘<samp>pid</samp>’ log selector (see section
<a href="#SEC450">Reducing or increasing what is logged</a>). When this is set, the process id is output, in square
brackets, immediately after the time and date.
</p>
<table class="menu" border="0" cellspacing="0">
<tr><td align="left" valign="top"><a href="#SEC436">49.1 Where the logs are written</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC437">49.2 Logging to local files that are periodically "cycled"</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC438">49.3 Datestamped log files</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC439">49.4 Logging to syslog</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC440">49.5 Log line flags</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC441">49.6 Logging message reception</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC442">49.7 Logging deliveries</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC443">49.8 Discarded deliveries</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC444">49.9 Deferred deliveries</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC445">49.10 Delivery failures</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC446">49.11 Fake deliveries</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC447">49.12 Completion</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC448">49.13 Summary of Fields in Log Lines</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC449">49.14 Other log entries</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC450">49.15 Reducing or increasing what is logged</a></td><td> </td><td align="left" valign="top">
</td></tr>
<tr><td align="left" valign="top"><a href="#SEC451">49.16 Message log</a></td><td> </td><td align="left" valign="top">
</td></tr>
</table>
<hr size="6">
<a name="Where-the-logs-are-written"></a>
<a name="SEC436"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC435" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC437" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.1 Where the logs are written </h2>
<p>The logs may be written to local files, or to syslog, or both. However, it
should be noted that many syslog implementations use UDP as a transport, and
are therefore unreliable in the sense that messages are not guaranteed to
arrive at the loghost, nor is the ordering of messages necessarily maintained.
It has also been reported that on large log files (tens of megabytes) you may
need to tweak syslog to prevent it syncing the file with each write - on
Linux this has been seen to make syslog take 90% plus of CPU time.
</p>
<p>The destination for Exim's logs is configured by setting LOG_FILE_PATH in
‘<tt>Local/Makefile</tt>’ or by setting <code>log_file_path</code> in the run time
configuration. This latter string is expanded, so it can contain, for example,
references to the host name:
</p>
<table><tr><td> </td><td><pre class="example">log_file_path = /var/log/$primary_hostname/exim_%slog
</pre></td></tr></table>
<p>It is generally advisable, however, to set the string in ‘<tt>Local/Makefile</tt>’
rather than at run time, because then the setting is available right from the
start of Exim's execution. Otherwise, if there's something it wants to log
before it has read the configuration file (for example, an error in the
configuration file) it will not use the path you want, and may not be able to
log at all.
</p>
<p>The value of LOG_FILE_PATH or <code>log_file_path</code> is a colon-separated
list, currently limited to at most two items. This is one option where the
facility for changing a list separator may not be used. The list must always be
colon-separated. If an item in the list is "syslog" then syslog is used;
otherwise the item must either be an absolute path, containing ‘<samp>%s</samp>’ at the
point where "main", "reject", or "panic" is to be inserted, or be empty,
implying the use of a default path.
</p>
<p>When Exim encounters an empty item in the list, it searches the list defined by
LOG_FILE_PATH, and uses the first item it finds that is neither empty nor
"syslog". This means that an empty item in <code>log_file_path</code> can be used to
mean "use the path specified at build time". It no such item exists, log
files are written in the ‘<tt>log</tt>’ subdirectory of the spool directory. This is
equivalent to the setting:
</p>
<table><tr><td> </td><td><pre class="example">log_file_path = $spool_directory/log/%slog
</pre></td></tr></table>
<p>If you do not specify anything at build time or run time, that is where the
logs are written.
</p>
<p>A log file path may also contain ‘<samp>%D</samp>’ if datestamped log file names are in
use - see section <a href="#SEC438">Datestamped log files</a> below.
</p>
<p>Here are some examples of possible settings:
</p>
<table><tr><td> </td><td><pre class="display">LOG_FILE_PATH=syslog syslog only
LOG_FILE_PATH=:syslog syslog and default path
LOG_FILE_PATH=syslog : /usr/log/exim_%s syslog and specified path
LOG_FILE_PATH=/usr/log/exim_%s specified path only
</pre></td></tr></table>
<p>If there are more than two paths in the list, the first is used and a panic
error is logged.
</p>
<hr size="6">
<a name="Logging-to-local-files-that-are-periodically-_0022cycled_0022"></a>
<a name="SEC437"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC436" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC438" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.2 Logging to local files that are periodically "cycled" </h2>
<p>Some operating systems provide centralized and standardized methods for cycling
log files. For those that do not, a utility script called <em>exicyclog</em> is
provided (see section <a href="spec_50.html#SEC458">Cycling log files (exicyclog)</a>). This renames and compresses the
main and reject logs each time it is called. The maximum number of old logs to
keep can be set. It is suggested this script is run as a daily <em>cron</em> job.
</p>
<p>An Exim delivery process opens the main log when it first needs to write to it,
and it keeps the file open in case subsequent entries are required - for
example, if a number of different deliveries are being done for the same
message. However, remote SMTP deliveries can take a long time, and this means
that the file may be kept open long after it is renamed if <em>exicyclog</em> or
something similar is being used to rename log files on a regular basis. To
ensure that a switch of log files is noticed as soon as possible, Exim calls
<code>stat()</code> on the main log's name before reusing an open file, and if the file
does not exist, or its inode has changed, the old file is closed and Exim
tries to open the main log from scratch. Thus, an old log file may remain open
for quite some time, but no Exim processes should write to it once it has been
renamed.
</p>
<hr size="6">
<a name="Datestamped-log-files"></a>
<a name="SEC438"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC437" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC439" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.3 Datestamped log files </h2>
<p>Instead of cycling the main and reject log files by renaming them
periodically, some sites like to use files whose names contain a datestamp,
for example, ‘<tt>mainlog-20031225</tt>’. The datestamp is in the form ‘<tt>yyyymmdd</tt>’.
Exim has support for this way of working. It is enabled by setting the
<code>log_file_path</code> option to a path that includes ‘<samp>%D</samp>’ at the point where the
datestamp is required. For example:
</p>
<table><tr><td> </td><td><pre class="example">log_file_path = /var/spool/exim/log/%slog-%D
log_file_path = /var/log/exim-%s-%D.log
log_file_path = /var/spool/exim/log/%D-%slog
</pre></td></tr></table>
<p>As before, ‘<samp>%s</samp>’ is replaced by "main" or "reject"; the following are
examples of names generated by the above examples:
</p>
<table><tr><td> </td><td><pre class="example">/var/spool/exim/log/mainlog-20021225
/var/log/exim-reject-20021225.log
/var/spool/exim/log/20021225-mainlog
</pre></td></tr></table>
<p>When this form of log file is specified, Exim automatically switches to new
files at midnight. It does not make any attempt to compress old logs; you
will need to write your own script if you require this. You should not
run <em>exicyclog</em> with this form of logging.
</p>
<p>The location of the panic log is also determined by <code>log_file_path</code>, but it
is not datestamped, because rotation of the panic log does not make sense.
When generating the name of the panic log, ‘<samp>%D</samp>’ is removed from the string.
In addition, if it immediately follows a slash, a following non-alphanumeric
character is removed; otherwise a preceding non-alphanumeric character is
removed. Thus, the three examples above would give these panic log names:
</p>
<table><tr><td> </td><td><pre class="example">/var/spool/exim/log/paniclog
/var/log/exim-panic.log
/var/spool/exim/log/paniclog
</pre></td></tr></table>
<hr size="6">
<a name="Logging-to-syslog"></a>
<a name="SEC439"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC438" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC440" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.4 Logging to syslog </h2>
<p>The use of syslog does not change what Exim logs or the format of its messages,
except in one respect. If <code>syslog_timestamp</code> is set false, the timestamps on
Exim's log lines are omitted when these lines are sent to syslog. Apart from
that, the same strings are written to syslog as to log files. The syslog
"facility" is set to LOG_MAIL, and the program name to "exim"
by default, but you can change these by setting the <code>syslog_facility</code> and
<code>syslog_processname</code> options, respectively. If Exim was compiled with
SYSLOG_LOG_PID set in ‘<tt>Local/Makefile</tt>’ (this is the default in
‘<tt>src/EDITME</tt>’), then, on systems that permit it (all except ULTRIX), the
LOG_PID flag is set so that the <code>syslog()</code> call adds the pid as well as
the time and host name to each line.
The three log streams are mapped onto syslog priorities as follows:
</p>
<ul class="toc">
<li>
<em>mainlog</em> is mapped to LOG_INFO
</li><li>
<em>rejectlog</em> is mapped to LOG_NOTICE
</li><li>
<em>paniclog</em> is mapped to LOG_ALERT
</li></ul>
<p>Many log lines are written to both <em>mainlog</em> and <em>rejectlog</em>, and some are
written to both <em>mainlog</em> and <em>paniclog</em>, so there will be duplicates if
these are routed by syslog to the same place. You can suppress this duplication
by setting <code>syslog_duplication</code> false.
</p>
<p>Exim's log lines can sometimes be very long, and some of its <em>rejectlog</em>
entries contain multiple lines when headers are included. To cope with both
these cases, entries written to syslog are split into separate <code>syslog()</code>
calls at each internal newline, and also after a maximum of
870 data characters. (This allows for a total syslog line length of 1024, when
additions such as timestamps are added.) If you are running a syslog
replacement that can handle lines longer than the 1024 characters allowed by
RFC 3164, you should set
</p>
<table><tr><td> </td><td><pre class="example">SYSLOG_LONG_LINES=yes
</pre></td></tr></table>
<p>in ‘<tt>Local/Makefile</tt>’ before building Exim. That stops Exim from splitting long
lines, but it still splits at internal newlines in <em>reject</em> log entries.
</p>
<p>To make it easy to re-assemble split lines later, each component of a split
entry starts with a string of the form [<<em>n</em>>/<<em>m</em>>] or [<<em>n</em>>\<<em>m</em>>]
where <<em>n</em>> is the component number and <<em>m</em>> is the total number of
components in the entry. The / delimiter is used when the line was split
because it was too long; if it was split because of an internal newline, the \
delimiter is used. For example, supposing the length limit to be 50 instead of
870, the following would be the result of a typical rejection message to
<em>mainlog</em> (LOG_INFO), each line in addition being preceded by the time, host
name, and pid as added by syslog:
</p>
<table><tr><td> </td><td><pre class="example">[1/5] 2002-09-16 16:09:43 16RdAL-0006pc-00 rejected from
[2/5] [127.0.0.1] (ph10): syntax error in 'From' header
[3/5] when scanning for sender: missing or malformed lo
[4/5] cal part in "<>" (envelope sender is <ph10@cam.exa
[5/5] mple>)
</pre></td></tr></table>
<p>The same error might cause the following lines to be written to "rejectlog"
(LOG_NOTICE):
</p>
<table><tr><td> </td><td><pre class="example">[1/18] 2002-09-16 16:09:43 16RdAL-0006pc-00 rejected fro
[2/18] m [127.0.0.1] (ph10): syntax error in 'From' head
[3/18] er when scanning for sender: missing or malformed
[4/18] local part in "<>" (envelope sender is <ph10@cam
[5\18] .example>)
[6\18] Recipients: ph10@some.domain.cam.example
[7\18] P Received: from [127.0.0.1] (ident=ph10)
[8\18] by xxxxx.cam.example with smtp (Exim 4.00)
[9\18] id 16RdAL-0006pc-00
[10/18] for ph10@cam.example; Mon, 16 Sep 2002 16:
[11\18] 09:43 +0100
[12\18] F From: <>
[13\18] Subject: this is a test header
[18\18] X-something: this is another header
[15/18] I Message-Id: <E16RdAL-0006pc-00@xxxxx.cam.examp
[16\18] le>
[17\18] B Bcc:
[18/18] Date: Mon, 16 Sep 2002 16:09:43 +0100
</pre></td></tr></table>
<p>Log lines that are neither too long nor contain newlines are written to syslog
without modification.
</p>
<p>If only syslog is being used, the Exim monitor is unable to provide a log tail
display, unless syslog is routing <em>mainlog</em> to a file on the local host and
the environment variable EXIMON_LOG_FILE_PATH is set to tell the monitor
where it is.
</p>
<hr size="6">
<a name="Log-line-flags"></a>
<a name="SEC440"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC439" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC441" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.5 Log line flags </h2>
<p>One line is written to the main log for each message received, and for each
successful, unsuccessful, and delayed delivery. These lines can readily be
picked out by the distinctive two-character flags that immediately follow the
timestamp. The flags are:
</p>
<table><tr><td> </td><td><pre class="display"><= message arrival
=> normal message delivery
-> additional address in same delivery
*> delivery suppressed by -N
** delivery failed; address bounced
== delivery deferred; temporary problem
</pre></td></tr></table>
<hr size="6">
<a name="Logging-message-reception"></a>
<a name="SEC441"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC440" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC442" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.6 Logging message reception </h2>
<p>The format of the single-line entry in the main log that is written for every
message received is shown in the basic example below, which is split over
several lines in order to fit it on the page:
</p>
<table><tr><td> </td><td><pre class="example">2002-10-31 08:57:53 16ZCW1-0005MB-00 <= kryten@dwarf.fict.example
H=mailer.fict.example [192.168.123.123] U=exim
P=smtp S=5678 id=<incoming message id>
</pre></td></tr></table>
<p>The address immediately following "<=" is the envelope sender address. A
bounce message is shown with the sender address "<>", and if it is locally
generated, this is followed by an item of the form
</p>
<table><tr><td> </td><td><pre class="example">R=<message id>
</pre></td></tr></table>
<p>which is a reference to the message that caused the bounce to be sent.
</p>
<a name="IDX2751"></a>
<a name="IDX2752"></a>
<p>For messages from other hosts, the H and U fields identify the remote host and
record the RFC 1413 identity of the user that sent the message, if one was
received. The number given in square brackets is the IP address of the sending
host. If there is a single, unparenthesized host name in the H field, as
above, it has been verified to correspond to the IP address (see the
<code>host_lookup</code> option). If the name is in parentheses, it was the name quoted
by the remote host in the SMTP HELO or EHLO command, and has not been
verified. If verification yields a different name to that given for HELO or
EHLO, the verified name appears first, followed by the HELO or EHLO
name in parentheses.
</p>
<p>Misconfigured hosts (and mail forgers) sometimes put an IP address, with or
without brackets, in the HELO or EHLO command, leading to entries in
the log containing text like these examples:
</p>
<table><tr><td> </td><td><pre class="example">H=(10.21.32.43) [192.168.8.34]
H=([10.21.32.43]) [192.168.8.34]
</pre></td></tr></table>
<p>This can be confusing. Only the final address in square brackets can be relied
on.
</p>
<p>For locally generated messages (that is, messages not received over TCP/IP),
the H field is omitted, and the U field contains the login name of the caller
of Exim.
</p>
<a name="IDX2753"></a>
<a name="IDX2754"></a>
<p>For all messages, the P field specifies the protocol used to receive the
message. This is the value that is stored in <code>$received_protocol</code>. In the case
of incoming SMTP messages, the value indicates whether or not any SMTP
extensions (ESMTP), encryption, or authentication were used. If the SMTP
session was encrypted, there is an additional X field that records the cipher
suite that was used.
</p>
<p>The protocol is set to "esmtpsa" or "esmtpa" for messages received from
hosts that have authenticated themselves using the SMTP AUTH command. The first
value is used when the SMTP connection was encrypted ("secure"). In this case
there is an additional item A= followed by the name of the authenticator that
was used. If an authenticated identification was set up by the authenticator's
<code>server_set_id</code> option, this is logged too, separated by a colon from the
authenticator name.
</p>
<a name="IDX2755"></a>
<p>The id field records the existing message id, if present. The size of the
received message is given by the S field. When the message is delivered,
headers may be removed or added, so that the size of delivered copies of the
message may not correspond with this value (and indeed may be different to each
other).
</p>
<p>The <code>log_selector</code> option can be used to request the logging of additional
data when a message is received. See section <a href="#SEC450">Reducing or increasing what is logged</a> below.
</p>
<hr size="6">
<a name="Logging-deliveries"></a>
<a name="SEC442"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC441" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC443" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.7 Logging deliveries </h2>
<p>The format of the single-line entry in the main log that is written for every
delivery is shown in one of the examples below, for local and remote
deliveries, respectively. Each example has been split into two lines in order
to fit it on the page:
</p>
<table><tr><td> </td><td><pre class="example">2002-10-31 08:59:13 16ZCW1-0005MB-00 => marv
<marv@hitch.fict.example> R=localuser T=local_delivery
2002-10-31 09:00:10 16ZCW1-0005MB-00 =>
monk@holistic.fict.example R=dnslookup T=remote_smtp
H=holistic.fict.example [192.168.234.234]
</pre></td></tr></table>
<p>For ordinary local deliveries, the original address is given in angle brackets
after the final delivery address, which might be a pipe or a file. If
intermediate address(es) exist between the original and the final address, the
last of these is given in parentheses after the final address. The R and T
fields record the router and transport that were used to process the address.
</p>
<p>If a shadow transport was run after a successful local delivery, the log line
for the successful delivery has an item added on the end, of the form
</p>
<table><tr><td> </td><td><pre class="display">ST=<shadow transport name>
</pre></td></tr></table>
<p>If the shadow transport did not succeed, the error message is put in
parentheses afterwards.
</p>
<a name="IDX2756"></a>
<p>When more than one address is included in a single delivery (for example, two
SMTP RCPT commands in one transaction) the second and subsequent addresses are
flagged with ‘<samp>-></samp>’ instead of ‘<samp>=></samp>’. When two or more messages are delivered
down a single SMTP connection, an asterisk follows the IP address in the log
lines for the second and subsequent messages.
</p>
<p>The generation of a reply message by a filter file gets logged as a
"delivery" to the addressee, preceded by ">".
</p>
<p>The <code>log_selector</code> option can be used to request the logging of additional
data when a message is delivered. See section <a href="#SEC450">Reducing or increasing what is logged</a> below.
</p>
<hr size="6">
<a name="Discarded-deliveries"></a>
<a name="SEC443"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC442" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC444" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.8 Discarded deliveries </h2>
<p>When a message is discarded as a result of the command "seen finish" being
obeyed in a filter file which generates no deliveries, a log entry of the form
</p>
<table><tr><td> </td><td><pre class="example">2002-12-10 00:50:49 16auJc-0001UB-00 => discarded
<low.club@bridge.example> R=userforward
</pre></td></tr></table>
<p>is written, to record why no deliveries are logged. When a message is discarded
because it is aliased to ":blackhole:" the log line is like this:
</p>
<table><tr><td> </td><td><pre class="example">1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole:
<hole@nowhere.example> R=blackhole_router
</pre></td></tr></table>
<hr size="6">
<a name="Deferred-deliveries"></a>
<a name="SEC444"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC443" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC445" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.9 Deferred deliveries </h2>
<p>When a delivery is deferred, a line of the following form is logged:
</p>
<table><tr><td> </td><td><pre class="example">2002-12-19 16:20:23 16aiQz-0002Q5-00 == marvin@endrest.example
R=dnslookup T=smtp defer (146): Connection refused
</pre></td></tr></table>
<p>In the case of remote deliveries, the error is the one that was given for the
last IP address that was tried. Details of individual SMTP failures are also
written to the log, so the above line would be preceded by something like
</p>
<table><tr><td> </td><td><pre class="example">2002-12-19 16:20:23 16aiQz-0002Q5-00 Failed to connect to
mail1.endrest.example [192.168.239.239]: Connection refused
</pre></td></tr></table>
<p>When a deferred address is skipped because its retry time has not been reached,
a message is written to the log, but this can be suppressed by setting an
appropriate value in <code>log_selector</code>.
</p>
<hr size="6">
<a name="Delivery-failures"></a>
<a name="SEC445"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC444" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC446" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.10 Delivery failures </h2>
<p>If a delivery fails because an address cannot be routed, a line of the
following form is logged:
</p>
<table><tr><td> </td><td><pre class="example">1995-12-19 16:20:23 0tRiQz-0002Q5-00 ** jim@trek99.example
<jim@trek99.example>: unknown mail domain
</pre></td></tr></table>
<p>If a delivery fails at transport time, the router and transport are shown, and
the response from the remote host is included, as in this example:
</p>
<table><tr><td> </td><td><pre class="example">2002-07-11 07:14:17 17SXDU-000189-00 ** ace400@pb.example
R=dnslookup T=remote_smtp: SMTP error from remote mailer
after pipelined RCPT TO:<ace400@pb.example>: host
pbmail3.py.example [192.168.63.111]: 553 5.3.0
<ace400@pb.example>...Addressee unknown
</pre></td></tr></table>
<p>The word "pipelined" indicates that the SMTP PIPELINING extension was being
used. See <code>hosts_avoid_esmtp</code> in the <code>smtp</code> transport for a way of
disabling PIPELINING. The log lines for all forms of delivery failure are
flagged with ‘<samp>**</samp>’.
</p>
<hr size="6">
<a name="Fake-deliveries"></a>
<a name="SEC446"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC445" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC447" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.11 Fake deliveries </h2>
<p>If a delivery does not actually take place because the <code>-N</code> option has been
used to suppress it, a normal delivery line is written to the log, except that
"=>" is replaced by "*>".
</p>
<hr size="6">
<a name="Completion"></a>
<a name="SEC447"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC446" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC448" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.12 Completion </h2>
<p>A line of the form
</p>
<table><tr><td> </td><td><pre class="example">2002-10-31 09:00:11 16ZCW1-0005MB-00 Completed
</pre></td></tr></table>
<p>is written to the main log when a message is about to be removed from the spool
at the end of its processing.
</p>
<hr size="6">
<a name="Summary-of-Fields-in-Log-Lines"></a>
<a name="SEC448"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC447" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC449" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.13 Summary of Fields in Log Lines </h2>
<p>A summary of the field identifiers that are used in log lines is shown in
the following table:
</p>
<table><tr><td> </td><td><pre class="display">A authenticator name (and optional id)
C SMTP confirmation on delivery
command list for "no mail in SMTP session"
CV certificate verification status
D duration of "no mail in SMTP session"
DN distinguished name from peer certificate
DT on => lines: time taken for a delivery
F sender address (on delivery lines)
H host name and IP address
I local interface used
id message id for incoming message
P on <= lines: protocol used
on => and ** lines: return path
QT on => lines: time spent on queue so far
on "Completed" lines: time spent on queue
R on <= lines: reference for local bounce
on => ** and == lines: router name
S size of message
ST shadow transport name
T on <= lines: message subject (topic)
on => ** and == lines: transport name
U local user or RFC 1413 identity
X TLS cipher suite
</pre></td></tr></table>
<hr size="6">
<a name="Other-log-entries"></a>
<a name="SEC449"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC448" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC450" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.14 Other log entries </h2>
<p>Various other types of log entry are written from time to time. Most should be
self-explanatory. Among the more common are:
</p>
<ul class="toc">
<li>
<a name="IDX2757"></a>
<em>retry time not reached</em>An address previously suffered a temporary error
during routing or local delivery, and the time to retry has not yet arrived.
This message is not written to an individual message log file unless it happens
during the first delivery attempt.
</li><li>
<em>retry time not reached for any host</em>An address previously suffered
temporary errors during remote delivery, and the retry time has not yet arrived
for any of the hosts to which it is routed.
</li><li>
<a name="IDX2758"></a>
<em>spool file locked</em>An attempt to deliver a message cannot proceed because
some other Exim process is already working on the message. This can be quite
common if queue running processes are started at frequent intervals. The
<em>exiwhat</em> utility script can be used to find out what Exim processes are
doing.
</li><li>
<a name="IDX2759"></a>
<em>error ignored</em>There are several circumstances that give rise to this
message:
<ol>
<li>
Exim failed to deliver a bounce message whose age was greater than
<code>ignore_bounce_errors_after</code>. The bounce was discarded.
</li><li>
A filter file set up a delivery using the "noerror" option, and the delivery
failed. The delivery was discarded.
</li><li>
A delivery set up by a router configured with
<table><tr><td> </td><td><pre class="example"> errors_to = <>
</pre></td></tr></table>
<p>failed. The delivery was discarded.
</p></li></ol>
</li></ul>
<hr size="6">
<a name="Reducing-or-increasing-what-is-logged"></a>
<a name="SEC450"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC449" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="#SEC451" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.15 Reducing or increasing what is logged </h2>
<p>By setting the <code>log_selector</code> global option, you can disable some of Exim's
default logging, or you can request additional logging. The value of
<code>log_selector</code> is made up of names preceded by plus or minus characters. For
example:
</p>
<table><tr><td> </td><td><pre class="example">log_selector = +arguments -retry_defer
</pre></td></tr></table>
<p>The list of optional log items is in the following table, with the default
selection marked by asterisks:
</p>
<table><tr><td> </td><td><pre class="display">*acl_warn_skipped skipped warn statement in ACL
address_rewrite address rewriting
all_parents all parents in => lines
arguments command line arguments
*connection_reject connection rejections
*delay_delivery immediate delivery delayed
deliver_time time taken to perform delivery
delivery_size add S=nnn to => lines
*dnslist_defer defers of DNS list (aka RBL) lookups
*etrn ETRN commands
*host_lookup_failed as it says
ident_timeout timeout for ident connection
incoming_interface incoming interface on <= lines
incoming_port incoming port on <= lines
*lost_incoming_connection as it says (includes timeouts)
outgoing_port add remote port to => lines
*queue_run start and end queue runs
queue_time time on queue for one recipient
queue_time_overall time on queue for whole message
pid Exim process id
received_recipients recipients on <= lines
received_sender sender on <= lines
*rejected_header header contents on reject log
*retry_defer "retry time not reached"
return_path_on_delivery put return path on => and ** lines
sender_on_delivery add sender to => lines
*sender_verify_fail sender verification failures
*size_reject rejection because too big
*skip_delivery delivery skipped in a queue run
smtp_confirmation SMTP confirmation on => lines
smtp_connection SMTP connections
smtp_incomplete_transaction incomplete SMTP transactions
smtp_no_mail session with no MAIL commands
smtp_protocol_error SMTP protocol errors
smtp_syntax_error SMTP syntax errors
subject contents of Subject: on <= lines
tls_certificate_verified certificate verification status
*tls_cipher TLS cipher suite on <= and => lines
tls_peerdn TLS peer DN on <= and => lines
unknown_in_list DNS lookup failed in list match
all all of the above
</pre></td></tr></table>
<p>More details on each of these items follows:
</p>
<ul class="toc">
<li>
<a name="IDX2760"></a>
<code>acl_warn_skipped</code>: When an ACL <code>warn</code> statement is skipped because one of
its conditions cannot be evaluated, a log line to this effect is written if
this log selector is set.
</li><li>
<a name="IDX2761"></a>
<a name="IDX2762"></a>
<code>address_rewrite</code>: This applies both to global rewrites and per-transport
rewrites, but not to rewrites in filters run as an unprivileged user (because
such users cannot access the log).
</li><li>
<a name="IDX2763"></a>
<code>all_parents</code>: Normally only the original and final addresses are logged on
delivery lines; with this selector, intermediate parents are given in
parentheses between them.
</li><li>
<a name="IDX2764"></a>
<a name="IDX2765"></a>
<code>arguments</code>: This causes Exim to write the arguments with which it was called
to the main log, preceded by the current working directory. This is a debugging
feature, added to make it easier to find out how certain MUAs call
‘<tt>/usr/sbin/sendmail</tt>’. The logging does not happen if Exim has given up root
privilege because it was called with the <code>-C</code> or <code>-D</code> options. Arguments
that are empty or that contain white space are quoted. Non-printing characters
are shown as escape sequences. This facility cannot log unrecognized arguments,
because the arguments are checked before the configuration file is read. The
only way to log such cases is to interpose a script such as ‘<tt>util/logargs.sh</tt>’
between the caller and Exim.
</li><li>
<a name="IDX2766"></a>
<code>connection_reject</code>: A log entry is written whenever an incoming SMTP
connection is rejected, for whatever reason.
</li><li>
<a name="IDX2767"></a>
<a name="IDX2768"></a>
<code>delay_delivery</code>: A log entry is written whenever a delivery process is not
started for an incoming message because the load is too high or too many
messages were received on one connection. Logging does not occur if no delivery
process is started because <code>queue_only</code> is set or <code>-odq</code> was used.
</li><li>
<a name="IDX2769"></a>
<code>deliver_time</code>: For each delivery, the amount of real time it has taken to
perform the actual delivery is logged as DT=<<em>time</em>>, for example, ‘<samp>DT=1s</samp>’.
</li><li>
<a name="IDX2770"></a>
<a name="IDX2771"></a>
<code>delivery_size</code>: For each delivery, the size of message delivered is added to
the "=>" line, tagged with S=.
</li><li>
<a name="IDX2772"></a>
<a name="IDX2773"></a>
<a name="IDX2774"></a>
<code>dnslist_defer</code>: A log entry is written if an attempt to look up a host in a
DNS black list suffers a temporary error.
</li><li>
<a name="IDX2775"></a>
<a name="IDX2776"></a>
<code>etrn</code>: Every valid ETRN command that is received is logged, before the ACL
is run to determine whether or not it is actually accepted. An invalid ETRN
command, or one received within a message transaction is not logged by this
selector (see <code>smtp_syntax_error</code> and <code>smtp_protocol_error</code>).
</li><li>
<a name="IDX2777"></a>
<code>host_lookup_failed</code>: When a lookup of a host's IP addresses fails to find
any addresses, or when a lookup of an IP address fails to find a host name, a
log line is written. This logging does not apply to direct DNS lookups when
routing email addresses, but it does apply to "byname" lookups.
</li><li>
<a name="IDX2778"></a>
<a name="IDX2779"></a>
<code>ident_timeout</code>: A log line is written whenever an attempt to connect to a
client's ident port times out.
</li><li>
<a name="IDX2780"></a>
<a name="IDX2781"></a>
<code>incoming_interface</code>: The interface on which a message was received is added
to the "<=" line as an IP address in square brackets, tagged by I= and
followed by a colon and the port number. The local interface and port are also
added to other SMTP log lines, for example "SMTP connection from", and to
rejection lines.
</li><li>
<a name="IDX2782"></a>
<a name="IDX2783"></a>
<a name="IDX2784"></a>
<a name="IDX2785"></a>
<a name="IDX2786"></a>
<code>incoming_port</code>: The remote port number from which a message was received is
added to log entries and <em>Received:</em> header lines, following the IP address
in square brackets, and separated from it by a colon. This is implemented by
changing the value that is put in the <code>$sender_fullhost</code> and
<code>$sender_rcvhost</code> variables. Recording the remote port number has become more
important with the widening use of NAT (see RFC 2505).
</li><li>
<a name="IDX2787"></a>
<code>lost_incoming_connection</code>: A log line is written when an incoming SMTP
connection is unexpectedly dropped.
</li><li>
<a name="IDX2788"></a>
<a name="IDX2789"></a>
<a name="IDX2790"></a>
<code>outgoing_port</code>: The remote port number is added to delivery log lines (those
containing => tags) following the IP address. This option is not included in
the default setting, because for most ordinary configurations, the remote port
number is always 25 (the SMTP port).
</li><li>
<a name="IDX2791"></a>
<a name="IDX2792"></a>
<code>pid</code>: The current process id is added to every log line, in square brackets,
immediately after the time and date.
</li><li>
<a name="IDX2793"></a>
<a name="IDX2794"></a>
<code>queue_run</code>: The start and end of every queue run are logged.
</li><li>
<a name="IDX2795"></a>
<code>queue_time</code>: The amount of time the message has been in the queue on the
local host is logged as QT=<<em>time</em>> on delivery (‘<samp>=></samp>’) lines, for example,
‘<samp>QT=3m45s</samp>’. The clock starts when Exim starts to receive the message, so it
includes reception time as well as the delivery time for the current address.
This means that it may be longer than the difference between the arrival and
delivery log line times, because the arrival log line is not written until the
message has been successfully received.
</li><li>
<code>queue_time_overall</code>: The amount of time the message has been in the queue on
the local host is logged as QT=<<em>time</em>> on "Completed" lines, for
example, ‘<samp>QT=3m45s</samp>’. The clock starts when Exim starts to receive the
message, so it includes reception time as well as the total delivery time.
</li><li>
<a name="IDX2796"></a>
<code>received_recipients</code>: The recipients of a message are listed in the main log
as soon as the message is received. The list appears at the end of the log line
that is written when a message is received, preceded by the word "for". The
addresses are listed after they have been qualified, but before any rewriting
has taken place.
Recipients that were discarded by an ACL for MAIL or RCPT do not appear
in the list.
</li><li>
<a name="IDX2797"></a>
<code>received_sender</code>: The unrewritten original sender of a message is added to
the end of the log line that records the message's arrival, after the word
"from" (before the recipients if <code>received_recipients</code> is also set).
</li><li>
<a name="IDX2798"></a>
<code>rejected_header</code>: If a message's header has been received at the time a
rejection is written to the reject log, the complete header is added to the
log. Header logging can be turned off individually for messages that are
rejected by the <code>local_scan()</code> function (see section <a href="spec_42.html#SEC367">API for local_scan()</a>).
</li><li>
<a name="IDX2799"></a>
<code>retry_defer</code>: A log line is written if a delivery is deferred because a
retry time has not yet been reached. However, this "retry time not reached"
message is always omitted from individual message logs after the first delivery
attempt.
</li><li>
<a name="IDX2800"></a>
<code>return_path_on_delivery</code>: The return path that is being transmitted with
the message is included in delivery and bounce lines, using the tag P=.
This is omitted if no delivery actually happens, for example, if routing fails,
or if delivery is to ‘<tt>/dev/null</tt>’ or to ‘<samp>:blackhole:</samp>’.
</li><li>
<a name="IDX2801"></a>
<code>sender_on_delivery</code>: The message's sender address is added to every delivery
and bounce line, tagged by F= (for "from").
This is the original sender that was received with the message; it is not
necessarily the same as the outgoing return path.
</li><li>
<a name="IDX2802"></a>
<code>sender_verify_fail</code>: If this selector is unset, the separate log line that
gives details of a sender verification failure is not written. Log lines for
the rejection of SMTP commands contain just "sender verify failed", so some
detail is lost.
</li><li>
<a name="IDX2803"></a>
<code>size_reject</code>: A log line is written whenever a message is rejected because
it is too big.
</li><li>
<a name="IDX2804"></a>
<a name="IDX2805"></a>
<code>skip_delivery</code>: A log line is written whenever a message is skipped during a
queue run because it is frozen or because another process is already delivering
it.
<a name="IDX2806"></a>
The message that is written is "spool file is locked".
</li><li>
<a name="IDX2807"></a>
<a name="IDX2808"></a>
<code>smtp_confirmation</code>: The response to the final "." in the SMTP dialogue for
outgoing messages is added to delivery log lines in the form ‘<samp>C=</samp>’<<em>text</em>>.
A number of MTAs (including Exim) return an identifying string in this
response.
</li><li>
<a name="IDX2809"></a>
<a name="IDX2810"></a>
<code>smtp_connection</code>: A log line is written whenever an SMTP connection is
established or closed, unless the connection is from a host that matches
<code>hosts_connection_nolog</code>. (In contrast, <code>lost_incoming_connection</code> applies
only when the closure is unexpected.) This applies to connections from local
processes that use <code>-bs</code> as well as to TCP/IP connections. If a connection is
dropped in the middle of a message, a log line is always written, whether or
not this selector is set, but otherwise nothing is written at the start and end
of connections unless this selector is enabled.
<p>For TCP/IP connections to an Exim daemon, the current number of connections is
included in the log message for each new connection, but note that the count is
reset if the daemon is restarted.
Also, because connections are closed (and the closure is logged) in
subprocesses, the count may not include connections that have been closed but
whose termination the daemon has not yet noticed. Thus, while it is possible to
match up the opening and closing of connections in the log, the value of the
logged counts may not be entirely accurate.
</p>
</li><li>
<a name="IDX2811"></a>
<a name="IDX2812"></a>
<code>smtp_incomplete_transaction</code>: When a mail transaction is aborted by
RSET, QUIT, loss of connection, or otherwise, the incident is logged,
and the message sender plus any accepted recipients are included in the log
line. This can provide evidence of dictionary attacks.
</li><li>
<a name="IDX2813"></a>
<a name="IDX2814"></a>
<code>smtp_no_mail</code>: A line is written to the main log whenever an accepted SMTP
connection terminates without having issued a MAIL command. This includes both
the case when the connection is dropped, and the case when QUIT is used. It
does not include cases where the connection is rejected right at the start (by
an ACL, or because there are too many connections, or whatever). These cases
already have their own log lines.
<p>The log line that is written contains the identity of the client in the usual
way, followed by D= and a time, which records the duration of the connection.
If the connection was authenticated, this fact is logged exactly as it is for
an incoming message, with an A= item. If the connection was encrypted, CV=,
DN=, and X= items may appear as they do for an incoming message, controlled by
the same logging options.
</p>
<p>Finally, if any SMTP commands were issued during the connection, a C= item
is added to the line, listing the commands that were used. For example,
</p>
<table><tr><td> </td><td><pre class="example">C=EHLO,QUIT
</pre></td></tr></table>
<p>shows that the client issued QUIT straight after EHLO. If there were fewer
than 20 commands, they are all listed. If there were more than 20 commands,
the last 20 are listed, preceded by "...". However, with the default
setting of 10 for <code>smtp_accep_max_nonmail</code>, the connection will in any case
have been aborted before 20 non-mail commands are processed.
</p>
</li><li>
<a name="IDX2815"></a>
<a name="IDX2816"></a>
<code>smtp_protocol_error</code>: A log line is written for every SMTP protocol error
encountered. Exim does not have perfect detection of all protocol errors
because of transmission delays and the use of pipelining. If PIPELINING has
been advertised to a client, an Exim server assumes that the client will use
it, and therefore it does not count "expected" errors (for example, RCPT
received after rejecting MAIL) as protocol errors.
</li><li>
<a name="IDX2817"></a>
<a name="IDX2818"></a>
<a name="IDX2819"></a>
<a name="IDX2820"></a>
<a name="IDX2821"></a>
<code>smtp_syntax_error</code>: A log line is written for every SMTP syntax error
encountered. An unrecognized command is treated as a syntax error. For an
external connection, the host identity is given; for an internal connection
using <code>-bs</code> the sender identification (normally the calling user) is given.
</li><li>
<a name="IDX2822"></a>
<a name="IDX2823"></a>
<code>subject</code>: The subject of the message is added to the arrival log line,
preceded by "T=" (T for "topic", since S is already used for "size").
Any MIME "words" in the subject are decoded. The <code>print_topbitchars</code> option
specifies whether characters with values greater than 127 should be logged
unchanged, or whether they should be rendered as escape sequences.
</li><li>
<a name="IDX2824"></a>
<code>tls_certificate_verified</code>: An extra item is added to <= and => log lines
when TLS is in use. The item is ‘<samp>CV=yes</samp>’ if the peer's certificate was
verified, and ‘<samp>CV=no</samp>’ if not.
</li><li>
<a name="IDX2825"></a>
<a name="IDX2826"></a>
<code>tls_cipher</code>: When a message is sent or received over an encrypted
connection, the cipher suite used is added to the log line, preceded by X=.
</li><li>
<a name="IDX2827"></a>
<a name="IDX2828"></a>
<code>tls_peerdn</code>: When a message is sent or received over an encrypted
connection, and a certificate is supplied by the remote host, the peer DN is
added to the log line, preceded by DN=.
</li><li>
<a name="IDX2829"></a>
<code>unknown_in_list</code>: This setting causes a log entry to be written when the
result of a list match is failure because a DNS lookup failed.
</li></ul>
<hr size="6">
<a name="Message-log"></a>
<a name="SEC451"></a>
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC450" title="Previous section in reading order"> < </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next section in reading order"> > </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="#SEC435" title="Up section"> Up </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<h2 class="section"> 49.16 Message log </h2>
<p>In addition to the general log files, Exim writes a log file for each message
that it handles. The names of these per-message logs are the message ids, and
they are kept in the ‘<tt>msglog</tt>’ sub-directory of the spool directory. Each
message log contains copies of the log lines that apply to the message. This
makes it easier to inspect the status of an individual message without having
to search the main log. A message log is deleted when processing of the message
is complete, unless <code>preserve_message_logs</code> is set, but this should be used
only with great care because they can fill up your disk very quickly.
</p>
<p>On a heavily loaded system, it may be desirable to disable the use of
per-message logs, in order to reduce disk I/O. This can be done by setting the
<code>message_logs</code> option false.
<a name="IDX2830"></a>
</p>
<hr size="6">
<table cellpadding="1" cellspacing="1" border="0">
<tr><td valign="middle" align="left">[<a href="#SEC435" title="Beginning of this chapter or previous chapter"> << </a>]</td>
<td valign="middle" align="left">[<a href="spec_50.html#SEC452" title="Next chapter"> >> </a>]</td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left"> </td>
<td valign="middle" align="left">[<a href="spec.html#SEC_Top" title="Cover (top) of document">Top</a>]</td>
<td valign="middle" align="left">[Contents]</td>
<td valign="middle" align="left">[<a href="spec_55.html#SEC493" title="Index">Index</a>]</td>
<td valign="middle" align="left">[<a href="spec_abt.html#SEC_About" title="About (help)"> ? </a>]</td>
</tr></table>
<p>
<font size="-1">
This document was generated on <i>September, 10 2009</i> using <a href="http://www.nongnu.org/texi2html/"><i>texi2html 1.78</i></a>.
</font>
<br>
</p>
</body>
</html>
distrib
>
Mandriva
>
2010.0
>
i586
>
media
>
contrib-release
>
by-pkgid
>
a4080654d049ad31b216b761b9173c1f
>
files
>
153
