need to find when an email was sent

keat63

• October 30, 2015 09:16

I'm trying to determine, when a PHP script may have sent an email to a customer. Are there any scripts I could run to search for his email address across multiple log files ? I'm quite possibly looking at something which may have happened 4 months ago, and i don't see any mail logs going back this far, unless there are any archives. I have the IP address of the device which initiated the PHP file, so if there's anything i could use to search for this, may help.

• 

  madmanmachines

  • October 30, 2015 14:45

  Hi, What do you have to go off? Do you have the email? If so, locate the exim id from the headers(e.g. 1ZsAqY-0000jk-3r). Use this to search as below:
  zgrep exim-message-id /var/log/exim_mainlog*
  If you don't have the message id, I would recommend searching by the current working directory of where the mail script is located. If the script was at '/home/bob/mailscript.php' then:
  zgrep -A1 "cwd=/home/bob" /var/log/exim_mainlog*
  Thanks,

  0
• 

  cPanelMichael

  • October 30, 2015 18:08

  Hello :) It depends on how far back your Exim logs go. You can search for the email address in /var/log/exim_mainlog and any archives of this log file with a command such as:
  exigrep user@domain /var/log/exim_mainlog*
  Thank you.

  0

Please sign in to leave a comment.