====== Exim4 - Searching the logs ======

The **exigrep** utility (not to be confused with **exiqgrep**) is used to search an exim log for a string or pattern.  It will print all log entries with the same internal message-id as those that matched the pattern, which is very handy since any message will take up at least three lines in the log.  exigrep will search the entire content of a log entry, not just particular fields.

One can search for messages sent from a particular IP address:

<code bash>
exigrep '<= .* \[12.34.56.78\] ' /path/to/exim_log
</code>

Search for messages sent to a particular IP address:

<code bash>
root@localhost# exigrep '=> .* \[12.34.56.78\]' /path/to/exim_log
</code>


This example searches for outgoing messages, which have the "=>" symbol, sent to "user@domain.tld". The pipe to grep for the "<=" symbol will match only the lines with information on the sender - the From address, the sender's IP address, the message size, the message ID, and the subject line if you have enabled logging the subject. The purpose of doing such a search is that the desired information is not on the same log line as the string being searched for.

<code bash>
root@localhost# exigrep '=> .*user@domain.tld' /path/to/exim_log | fgrep '<='
</code>

Generate and display Exim stats from a logfile:

<code bash>
root@localhost# eximstats /path/to/exim_mainlog
</code>

Same as above, with less verbose output:

<code bash>
root@localhost# eximstats -ne -nr -nt /path/to/exim_mainlog
</code>


Same as above, for one particular day:

<code bash>
root@localhost# fgrep YYYY-MM-DD /path/to/exim_mainlog | eximstats
</code>