Hi All,
OK my server is very busy which is largely due to Exim. I found one issue and that is resolved now, but naturally there is more..

BTW, I am using CPanel / WHM.

I have checked the queue (which is growing quite rapidly) but that is only looking at one symptom rather than the problem. Ultimately I want to know where mail is coming from on the server. I.e. Is it busy because we are receiving loads of spam (which is what the queue has shown so far) or is somebody sending lots of mail from the box as well and if so how (Script or SMTP etc).

As far as I was aware the mail que is only used when mail cannot be delivered straight away, therefore is not really an accurate way of learning the mail issues on the server.

There are few things I'm unsure of. Sorry if these are quite basic:
1) From the mail logs I can see several things, but sometimes this is just "X message succesfull" where can I look up that message ID to find more information?
2) From the queue I sometimes see user "nobody" or "mailnull" what is this?
3) When using exiwhat, what are "standard results". What should I be looking out for.
4) Is there a better way than using the mail queue, mail log and exiwhat to find out the status of the mail server? Could you recommend a site/url for further detail?

Thanks Guys

hi,
if local mail is using exim as MDA then everything is going through the que
and the que only flushes as often as it's set too (Duh !)
(i think i'm just thinking out loud here -- there are so many way you can setup a mail system)

the junk for me it in /var/spool/exim
./log/mainlog

has a symbol to let you see if it's coming in or going out
for instance a mail comes in
2005-02-05 19:32:42 1CxaLy-0000YJ-2Y <= maryannclifton@schreiber2.de
then down below that with the same id is the delivery to me
2005-02-05 19:33:11 1CxaLy-0000YJ-2Y => me <me@localhost>
2005-02-05 19:33:11 1CxaLy-0000YJ-2Y Completed
you can look at the headers to the mail to see the entire route it took to where it is now if it's delivered locally

the only other thing i can think of is to ramp the log level
start exim with the -d9 flag (the lower the number the less the logging -- 9 is most)

i'm not sure what you mean by this one
i think post an example
for me que looks like
exim -bp
0m 2.0K 1CxfmB-0001aX-Gw <mildred.sewell93@uece.br>
me@localhost

but exim is running as it's own id perhaps someone there on your system got creative
show us
ps -C exim -F

don't know abut the other stuff but exim is fairly easy to controll so you should be able to figure out whats going on