Introduction

Exim is the default Mail Transfer Agent (MTA) used on many cPanel/WHM servers. When a server is suspected of sending a large volume of emails or spam, the eximstats utility can be used to analyze the Exim mail logs and identify the top email senders, recipients, and hosts.

This procedure explains how to generate an Exim statistics report to identify the top 10 spammers and review overall email activity on the server.

Prerequisites

Before proceeding, ensure the following:

  • Root or sudo access to the server.
  • Exim mail server is installed and running.
  • The Exim log file exists:/var/log/exim_mainlog
  • The eximstats utility is available:which eximstats Expected output:/usr/sbin/eximstats

Steps

Step 1: Generate the Exim Statistics Report

Run the following command:

/usr/sbin/eximstats -t10 /var/log/exim_mainlog > teststats

Explanation:

  • -t10 – Displays the top 10 entries for each statistics category.
  • /var/log/exim_mainlog – Exim mail log file to analyze.
  • > teststats – Saves the generated report to a file named teststats.

Step 2: View the Report

Open the generated report using one of the following commands:

less teststats

or

vi teststats

Step 3: Review the Statistics

The report contains multiple sections that help identify suspicious mail activity, including:

  • Top 10 local destinations by volume
  • Top 10 local destinations by message count
  • Top 10 sending hosts by volume
  • Top 10 sending hosts by message count
  • Top 10 sender email addresses
  • Top 10 sender system users
  • Top recipient addresses
  • Total messages received
  • Total messages delivered
  • Message delivery statistics
  • Bounce statistics
  • Mail routing information

Step 4: Identify Potential Spammers

Review the following sections carefully:

  • Users sending an unusually high number of emails.
  • Email accounts with abnormal outbound traffic.
  • Sending hosts generating excessive mail volume.
  • Repeated recipients or domains receiving large numbers of messages.

If a user or account is sending an unexpected volume of email, investigate further by:

  • Verifying whether the activity is legitimate.
  • Checking for compromised email accounts.
  • Reviewing authentication logs.
  • Inspecting web applications or scripts that may be sending spam.
  • Temporarily suspending the account if malicious activity is confirmed.

Example Command

/usr/sbin/eximstats -t10 /var/log/exim_mainlog > teststats
less teststats

Expected Outcome

After completing this procedure, you will have a detailed Exim statistics report that provides:

  • The top email senders.
  • The top sending system users.
  • The busiest sending hosts.
  • The most active recipients.
  • Overall email traffic statistics.

This information helps quickly identify compromised accounts, spam sources, or abnormal outbound email activity.

Conclusion

The eximstats utility is an effective tool for analyzing Exim mail logs and identifying high-volume email senders on a cPanel server. By generating and reviewing the top sender statistics, administrators can quickly detect potential spamming accounts, investigate suspicious activity, and take corrective actions to protect the server’s email reputation and prevent abuse. Regular monitoring of Exim statistics is recommended as part of routine server maintenance and email security practices.

Post Views: 252

Leave a Reply