Find Exim messages sent from one address to another
Build a paste-ready command, then review its compatibility and effects before running it.
awk -v sender=<sender-email> -v recipient=<recipient-email> '$4=="<=" && $5==sender {seen[$3]=1} ($4=="=>" || $4=="==" || $4=="**") && $5==recipient && seen[$3] {print}' /var/log/exim4/mainlogComplete required fields to copy the generated command.
read-onlyno known side effects Compatibility
One chronological log fileCorrelates the Exim message ID in field 3. Search each rotated mainlog separately when the transaction spans rotation.
Operational knowledgereview due 2027-01-19
Requirementsawkawk must be installed and available on PATH.
Version supportawk Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signals2026-07-23 09:12:06 1uH7aa-0004F2-2L => bob@example.net R=dnslookup T=remote_smtp H=mx.example.net [198.51.100.24] C="250 2.0.0 queued"Representative successful output; values vary with the selected target and system state.
Known errorsawk: command not foundawk is missing or is not available on PATH.
Verifyawk -v sender={{sender}} -v recipient={{recipient}} '$4=="<=" && $5==sender {seen[$3]=1} ($4=="=>" || $4=="==" || $4=="**") && $5==recipient && seen[$3] {print}' {{logFile}}The output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01awkCommandRuns the awk stage of this one-liner.
02-vOptionAssigns the following name and value before the awk program runs.
03sender=<sender-email>ParameterA value supplied in the Fill parameters section.
04-vOptionAssigns the following name and value before the awk program runs.
05recipient=<recipient-email>ParameterA value supplied in the Fill parameters section.
06'$4=="<=" && $5==sender {seen[$3]=1} ($4=="=>" || $4=="==" || $4=="**") && $5==recipient && seen[$3] {print}'ArgumentPasses '$4=="<=" && $5==sender {seen[$3]=1} ($4=="=>" || $4=="==" || $4=="**") && $5==recipient && seen[$3] {print}' to awk.
07<exim-log-file>ParameterA value supplied in the Fill parameters section.
The first rule records message IDs received from the sender; the second prints matching recipient delivery events for those IDs.
Example input
awk -v sender=alice@example.com -v recipient=bob@example.net '$4=="<=" && $5==sender {seen[$3]=1} ($4=="=>" || $4=="==" || $4=="**") && $5==recipient && seen[$3] {print}' /var/log/exim4/mainlog
Example output
2026-07-23 09:12:06 1uH7aa-0004F2-2L => bob@example.net R=dnslookup T=remote_smtp H=mx.example.net [198.51.100.24] C="250 2.0.0 queued"
Illustrative output — exact values vary by system and data.
Official sources
Related commands