Here are some useful things to know for managing an Exim 4 server. This assumes a prior working knowledge of SMTP, MTAs, and a UNIX shell prompt.

Message-IDs and spool files

The message-IDs that Exim uses to refer to messages in its queue are mixed-case alpha-numeric, and take the form of: XXXXXX-YYYYYY-ZZ. Most commands related to managing the queue and logging use these message-ids.

There are three — count ’em, THREE — files for each message in the spool directory. If you’re dealing with these files by hand, instead of using the appropriate exim commands as detailed below, make sure you get them all, and don’t leave Exim with remnants of messages in the queue. I used to mess directly with these files when I first started running Exim machines, but thanks to the utilities described below, I haven’t needed to do that in many months.

Files in /var/spool/exim/msglog contain logging information for each message and are named the same as the message-id.

Files in /var/spool/exim/input are named after the message-id, plus a suffix denoting whether it is the envelope header (-H) or message data (-D).

These directories may contain further hashed sub directories to deal with larger mail queues, so don’t expect everything to always appear directly in the top /var/spool/exim/input or /var/spool/exim/msglog directories; any searches or greps will need to be recursive. See if there is a proper way to do what you’re doing before working directly on the spool files.
Basic information

Print a count of the messages in the queue:

root@localhost# exim -bpc

Print a listing of the messages in the queue (time queued, size, message-id, sender, recipient):


root@localhost# exim -bp

Print a summary of messages in the queue (count, volume, oldest, newest, domain, and totals):


root@localhost# exim -bp | exiqsumm

Print what Exim is doing right now:


root@localhost# exiwhat

Test how exim will route a given address:


root@localhost# exim -bt alias@localdomain.com
user@thishost.com
router = localuser, transport = local_delivery
root@localhost# exim -bt user@thishost.com
user@thishost.com
router = localuser, transport = local_delivery
root@localhost# exim -bt user@remotehost.com
router = lookuphost, transport = remote_smtp
host mail.remotehost.com [1.2.3.4] MX=0

Run a pretend SMTP transaction from the command line, as if it were coming from the given IP address. This will display Exim’s checks, ACLs, and filters as they are applied. The message will NOT actually be delivered.


root@localhost# exim -bh 192.168.11.22

Display all of Exim’s configuration settings:


root@localhost# exim -bP

Searching the queue with exiqgrep

Exim includes a utility that is quite nice for grepping through the queue, called exiqgrep. Learn it. Know it. Live it. If you’re not using this, and if you’re not familiar with the various flags it uses, you’re probably doing things the hard way, like piping `exim -bp` into awk, grep, cut, or `wc -l`. Don’t make life harder than it already is.

First, various flags that control what messages are matched. These can be combined to come up with a very particular search.

Use -f to search the queue for messages from a specific sender:


root@localhost# exiqgrep -f [luser]@domain

Use -r to search the queue for messages for a specific recipient/domain:


root@localhost# exiqgrep -r [luser]@domain

Use -o to print messages older than the specified number of seconds. For example, messages older than 1 day:


root@localhost# exiqgrep -o 86400 [...]

Use -y to print messages that are younger than the specified number of seconds. For example, messages less than an hour old:


root@localhost# exiqgrep -y 3600 [...]

Use -s to match the size of a message with a regex. For example, 700-799 bytes:


root@localhost# exiqgrep -s '^7..$' [...]

Use -z to match only frozen messages, or -x to match only unfrozen messages.

There are also a few flags that control the display of the output.

Use -i to print just the message-id as a result of one of the above two searches:


root@localhost# exiqgrep -i [ -r | -f ] ...

Use -c to print a count of messages matching one of the above searches:


root@localhost# exiqgrep -c ...

Print just the message-id of the entire queue:


root@localhost# exiqgrep -i

Managing the queue

The main exim binary (/usr/sbin/exim) is used with various flags to make things happen to messages in the queue. Most of these require one or more message-IDs to be specified in the command line, which is where `exiqgrep -i` as described above really comes in handy.

Start a queue run:


root@localhost# exim -q -v

Start a queue run for just local deliveries:


root@localhost# exim -ql -v

Remove a message from the queue:


root@localhost# exim -Mrm [ ... ]

Freeze a message:


root@localhost# exim -Mf [ ... ]

Thaw a message:


root@localhost# exim -Mt [ ... ]

Deliver a message, whether it’s frozen or not, whether the retry time has been reached or not:


root@localhost# exim -M [ ... ]

Deliver a message, but only if the retry time has been reached:


root@localhost# exim -Mc [ ... ]

Force a message to fail and bounce as “cancelled by administrator”:


root@localhost# exim -Mg [ ... ]

Remove all frozen messages:


root@localhost# exiqgrep -z -i | xargs exim -Mrm

To remove all messages from the queue, enter:


# exim -bp | awk '/^ *[0-9]+[mhd]/{print "exim -Mrm " $3}' | bash

Or


# exim -bp | exiqgrep -i | xargs exim -Mrm

Remove all messages older than five days (86400 * 5 = 432000 seconds):


root@localhost# exiqgrep -o 432000 -i | xargs exim -Mrm

Freeze all queued mail from a given sender:


root@localhost# exiqgrep -i -f luser@example.tld | xargs exim -Mf

View a message’s headers:


root@localhost# exim -Mvh

View a message’s body:


root@localhost# exim -Mvb

View a message’s logs:


root@localhost# exim -Mvl

Add a recipient to a message:


root@localhost# exim -Mar <message-id> <address> [ <address> ... ]

Edit the sender of a message:


root@localhost# exim -Mes <address>

Access control

Exim allows you to apply access control lists at various points of the SMTP transaction by specifying an ACL to use and defining its conditions in exim.conf. You could start with the HELO string.


# Specify the ACL to use after HELO
acl_smtp_helo = check_helo

# Conditions for the check_helo ACL:
check_helo:

deny message = Gave HELO/EHLO as "friend"
log_message = HELO/EHLO friend
condition = ${if eq {$sender_helo_name}{friend} {yes}{no}}

deny message = Gave HELO/EHLO as our IP address
log_message = HELO/EHLO our IP address
condition = ${if eq {$sender_helo_name}{$interface_address} {yes}{no}}

accept

NOTE: Pursue HELO checking at your own peril. The HELO is fairly unimportant in the grand scheme of SMTP these days, so don’t put too much faith in whatever it contains. Some spam might seem to use a telltale HELO string, but you might be surprised at how many legitimate messages start off with a questionable HELO as well. Anyway, it’s just as easy for a spammer to send a proper HELO than it is to send HELO im.a.spammer, so consider yourself lucky if you’re able to stop much spam this way.

Next, you can perform a check on the sender address or remote host. This shows how to do that after the RCPT TO command; if you reject here, as opposed to rejecting after the MAIL FROM, you’ll have better data to log, such as who the message was intended for.

# Specify the ACL to use after RCPT TO
acl_smtp_rcpt = check_recipient

# Conditions for the check_recipient ACL
check_recipient:

# […]

drop hosts = /etc/exim_reject_hosts
drop senders = /etc/exim_reject_senders

# [ Probably a whole lot more… ]

This example uses two plain text files as blacklists. Add appropriate entries to these files – hostnames/IP addresses to /etc/exim_reject_hosts, addresses to /etc/exim_reject_senders, one entry per line.

It is also possible to perform content scanning using a regex against the body of a message, though obviously this can cause Exim to use more CPU than it otherwise would need to, especially on large messages.

# Specify the ACL to use after DATA
acl_smtp_data = check_message

# Conditions for the check_messages ACL
check_message:

deny message = “Sorry, Charlie: $regex_match_string”
regex = ^Subject:: .*Lower your self-esteem by becoming a sysadmin

accept

Fix SMTP-Auth for Pine

If pine can’t use SMTP authentication on an Exim host and just returns an “unable to authenticate” message without even asking for a password, add the following line to exim.conf:

begin authenticators

fixed_plain:
driver = plaintext
public_name = PLAIN
server_condition = “${perl{checkuserpass}{$1}{$2}{$3}}”
server_set_id = $2
> server_prompts = :

This was a problem on CPanel Exim builds awhile ago, but they seem to have added this line to their current stock configuration.
Log the subject line

This is one of the most useful configuration tweaks I’ve ever found for Exim. Add this to exim.conf, and you can log the subject lines of messages that pass through your server. This is great for troubleshooting, and for getting a very rough idea of what messages may be spam.

log_selector = +subject

Reducing or increasing what is logged.
Disable identd lookups

Frankly, I don’t think identd has been useful for a long time, if ever. Identd relies on the connecting host to confirm the identity (system UID) of the remote user who owns the process that is making the network connection. This may be of some use in the world of shell accounts and IRC users, but it really has no place on a high-volume SMTP server, where the UID is often simply “mail” or whatever the remote MTA runs as, which is useless to know. It’s overhead, and results in nothing but delays while the identd query is refused or times out. You can stop your Exim server from making these queries by setting the timeout to zero seconds in exim.conf:

rfc1413_query_timeout = 0s

Disable Attachment Blocking

To disable the executable-attachment blocking that many Cpanel servers do by default but don’t provide any controls for on a per-domain basis, add the following block to the beginning of the /etc/antivirus.exim file:

if $header_to: matches “example.com|example2.com”
then
finish
endif

It is probably possible to use a separate file to list these domains, but I haven’t had to do this enough times to warrant setting such a thing up.
Searching the logs with exigrep

The exigrep utility (not to be confused with exiqgrep) is used to search an exim log for a string or pattern. It will print all log entries with the same internal message-id as those that matched the pattern, which is very handy since any message will take up at least three lines in the log. exigrep will search the entire content of a log entry, not just particular fields.

One can search for messages sent from a particular IP address:

root@localhost# exigrep ‘<= .* [12.34.56.78] ‘ /path/to/exim_log Search for messages sent to a particular IP address: root@localhost# exigrep ‘=> .* [12.34.56.78]’ /path/to/exim_log

This example searches for outgoing messages, which have the “=>” symbol, sent to “user@domain.tld”. The pipe to grep for the “<=” symbol will match only the lines with information on the sender – the From address, the sender’s IP address, the message size, the message ID, and the subject line if you have enabled logging the subject. The purpose of doing such a search is that the desired information is not on the same log line as the string being searched for. root@localhost# exigrep ‘=> .*user@domain.tld’ /path/to/exim_log | fgrep ‘<=’

Generate and display Exim stats from a logfile:

root@localhost# eximstats /path/to/exim_mainlog

Same as above, with less verbose output:

root@localhost# eximstats -ne -nr -nt /path/to/exim_mainlog

Same as above, for one particular day:

root@localhost# fgrep YYYY-MM-DD /path/to/exim_mainlog | eximstats

Bonus!

To delete all queued messages containing a certain string in the body:

root@localhost# grep -lr ‘a certain string’ /var/spool/exim/input/ |
sed -e ‘s/^.*/([a-zA-Z0-9-]*)-[DH]$/1/g’ | xargs exim -Mrm

Note that the above only delves into /var/spool/exim in order to grep for queue files with the given string, and that’s just because exiqgrep doesn’t have a feature to grep the actual bodies of messages. If you are deleting these files directly, YOU ARE DOING IT WRONG! Use the appropriate exim command to properly deal with the queue.

If you have to feed many, many message-ids (such as the output of an `exiqgrep -i` command that returns a lot of matches) to an exim command, you may exhaust the limit of your shell’s command line arguments. In that case, pipe the listing of message-ids into xargs to run only a limited number of them at once. For example, to remove thousands of messages sent from joe@example.com:

root@localhost# exiqgrep -i -f ‘<joe@example.com>’ | xargs exim -Mrm

Speaking of “DOING IT WRONG” — Attention, CPanel forum readers

I get a number of hits to this page from a link in this post at the CPanel forums. The question is:

Due to spamming, spoofing from fields, etc., etc., etc., I am finding it necessary to spend more time to clear the exim queue from time to time. […] what command would I use to delete the queue

The answer is: Just turn exim off, because your customers are better off knowing that email simply isn’t running on your server, than having their queued messages deleted without notice.

Or, figure out what is happening. The examples given in that post pay no regard to the legitimacy of any message, they simply delete everything, making the presumption that if a message is in the queue, it’s junk. That is total fallacy. There are a number of reasons legitimate mail can end up in the queue. Maybe your backups or CPanel’s “upcp” process are running, and your load average is high — exim goes into a queue-only mode at a certain threshold, where it stops trying to deliver messages as they come in and just queues them until the load goes back down. Or, maybe it’s an outgoing message, and the DNS lookup failed, or the connection to the domain’s MX failed, or maybe the remote MX is busy or greylisting you with a 4xx deferral. These are all temporary failures, not permanent ones, and the whole point of having temporary failures in SMTP and a mail queue in your MTA is to be able to try again after awhile.

Exim already purges messages from the queue after the period of time specified in exim.conf. If you have this value set appropriately, there is absolutely no point in removing everything from your queue every day with a cron job. You will lose legitimate mail, and the sender and recipient will never know if or why it happened. Do not do this!

If you regularly have a large number of messages in your queue, find out why they are there. If they are outbound messages, see who is sending them, where they’re addressed to, and why they aren’t getting there. If they are inbound messages, find out why they aren’t getting delivered to your user’s account. If you need to delete some, use exiqgrep to pick out just the ones that should be deleted.
Reload the configuration

After making changes to exim.conf, you need to give the main exim pid a SIGHUP to re-exec it and have the configuration re-read. Sure, you could stop and start the service, but that’s overkill and causes a few seconds of unnecessary downtime. Just do this:

root@localhost# kill -HUP `cat /var/spool/exim/exim-daemon.pid`

You should then see something resembling the following in exim_mainlog:

pid 1079: SIGHUP received: re-exec daemon
exim 4.52 daemon started: pid=1079, -q1h, listening for SMTP on port 25 (IPv4)

psa-firewall

To start the service through the command line:

/etc/init.d/psa-firewall start

To stop the service through the command line:

/etc/init.d/psa-firewall stop

To restart the service through the command line:

/etc/init.d/psa-firewall restart

Configuration files are accessible at:

  • /usr/local/psa/var/modules/firewall/firewall-active.sh
  • /usr/local/psa/var/modules/firewall/firewall-emergency.sh
  • /usr/local/psa/var/modules/firewall/firewall-new.sh

psa-firewall (IP forwarding)

To start the service through the command line:

/etc/init.d/psa-firewall-forward start

To stop the service through the command line:

/etc/init.d/psa-firewall-forward stop

To restart the service through the command line:

/etc/init.d/psa-firewall-forward restart

Configuration files are accessible at:

  • /usr/local/psa/var/modules/firewall/ip_forward.active
  • /usr/local/psa/var/modules/firewall/ip_forward.saved

Telnet is most likely to be used by system administrators, program developers and anyone who has a need to use specific applications or data located at a particular host computer. It’s a network protocol used on the Internet or local area networks to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. Telnet does not installed automatically on CentOS 6.3. You can issue the following command to confirm that telnet is working :

telnet localhost 80

If telnet client does not installed, it should return something like :

[root@centos63 ~]# telnet localhost 80
-bash: telnet: command not found

Issue the following command to install telnet client :

[root@centos63 ~]# yum install telnet -y
Loaded plugins: fastestmirror, presto
Determining fastest mirrors
 * base: mirrors.hostemo.com
 * extras: mirrors.hostemo.com
 * updates: mirrors.hostemo.com
CentOS6.3-Repository                                                         | 4.0 kB     00:00 ...
base                                                                         | 3.7 kB     00:00
extras                                                                       | 3.0 kB     00:00
updates                                                                      | 3.5 kB     00:00
updates/primary_db                                                           | 2.2 MB     00:19
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package telnet.i686 1:0.17-47.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

====================================================================================================
 Package           Arch            Version                    Repository                       Size
====================================================================================================
Installing:
 telnet            i686            1:0.17-47.el6              CentOS6.3-Repository             56 k

Transaction Summary
====================================================================================================
Install       1 Package(s)

Total download size: 56 k
Installed size: 102 k
Downloading Packages:
Setting up and reading Presto delta metadata
Processing delta metadata
Package(s) data still to download: 56 k
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : 1:telnet-0.17-47.el6.i686                                                        1/1
  Verifying  : 1:telnet-0.17-47.el6.i686                                                        1/1

Installed:
  telnet.i686 1:0.17-47.el6

Complete!

If telnet client installed, it should return something like :

[root@centos63 ~]# telnet localhost 80
Trying ::1...
Connected to localhost.
Escape character is '^]'.

There are three steps to setting up DNS for websites hosted on your Dedicated using Plesk 12:

  1. Add your domain name to the Parallels Plesk Panel.
  2. Create and register two domain hosts.
  3. Assign your nameservers to your registered domain name.

Step 1 — Adding Your Domain Name to Parallels Plesk Panel

Before you can use DNS with a domain name, you have to add it to Parallels Plesk Panel.

[stextbox id=”info”]NOTE: If you have already set up a domain name in Parallels Plesk Panel, you can skip this step. To Add a Zone File for Your Domain Name in Parallels Plesk Panel[/stextbox]

Log in to Parallels Plesk Panel as an administrator at https://yourserverip:8443, where yourserverip is your server’s IP address.
Go to the Webspaces tab, and then click Add a webspace.
Complete the on-screen fields, and then click OK.

NOTE: The username and password you select here are your FTP credentials for this domain/webspace.

Step 2 — Adding/Editing the DNS Records in Plesk for a Domain

Creating and registering domain hosts let you use a custom domain name as your DNS server name. To Create and Register Your Domain Hosts in Parallels Plesk Panel:

Log in to Parallels Plesk Panel as an administrator.
Go to the Websites & Domains tab, and then click DNS Settings.

For the row with the Record Type of NS, click your domain name, change the following, and then click OK:

Record type — NS.
Domain Name — Leave this field.
Name server — Type ns1.coolexample.com, where coolexample.com is your domain name.

Capture1

For the row with the Host of ns.coolexample.com, where coolexample.com is your domain, click it, change the following, and then click OK See above):

Record type — A.
Domain Name — Type ns1.
IP Address — Enter your server’s IP address.

After

Capture2

Next, click Add Record, complete the following fields, and then click OK:

Record type — Select NS.
Domain Name — Leave this field blank.
Name server — Enter ns2.coolexample.com, where coolexample.com is your domain name.

Next, click Add Record, complete the following fields, and then click OK:

Record type — Select A.
Domain Name — Type ns2.
IP Address — Enter your server’s IP address
Click Update.

After

Capture3

Go to the Server tab in Plesk, and then, from the Server Management section, click Services Management.
Next to DNS Server (BIND), click Restart. Allow a few minutes for the service to restart.

NOTE: DNS changes can take 24-48 hours to propagate.

Step 3. Registering your Nameservers

Once you set up a domain name and create a zone file in Parallels Plesk Panel, you need to create and register two domain hosts for your domain name. For more information, see Registering Your Own Nameservers/Hosts. If your domain name is registered with another company, you need to contact them for instructions regarding domain host registration.

NOTE: You can use the two domain hosts you just created for other domains hosted on the same server. You do not need to create new domain hosts for each of your domains.

Editing the global php.ini at /usr/local/lib/php.ini does not increase values in the internal PHP for cPanel for PhpMyAdmin.

You have to edit the internal php.ini, which apparently it is reading from /usr/locafile.rather than /usr/local/cpanel/3rdparty/etc/phpmyadmin/php.ini file.

nano /usr/local/cpanel/3rdparty/etc/phpmyadmin/php.ini
; Maximum size of POST data that PHP will accept.
post_max_size = 50M
upload_max_size = 50M

Cannot login via ftp to the domain, the following error is displayed during the logging:

530 Login incorrect.

In the ‘/var/log/secure’ file you may find the following error:

Oct 1 12:55:15 web02 proftpd[20205]: 127.0.0.1 (91.204.25.4[91.204.25.4]) – USER test (Login failed): Invalid shell: ‘/bin/false’

Cause

The string ‘/bin/false’ is missed in the file ‘/etc/shells’.
Resolution

Add ‘/bin/false’ to the ‘/etc/shells’ file
Search words:
FTP
Invalid shell
530 Login incorrect
Error 530
ftp error plesk

Install eplel repo


# rpm -ivh http://mirror.vcu.edu/pub/gnu+linux/epel/6/i386/epel-release-6-8.noarch.rpm


# yum -y install vpnc
# chmod 700 /etc/vpnc/vpnc-script
# cp /etc/vpnc/default.conf /etc/vpnc/default.conf.orig

Save your .pnc file from Networking to /etc/vpnc/ folder

Install the VPN .pnc file as a default.conf file

Get the pcf to vpnc configuration file converter


# wget http://svn.unix-ag.uni-kl.de/vpnc/trunk/pcf2vpnc

Make it executable


# chmod +x pcf2vpnc

Move it to a place in our path


# mv pcf2vpnc /usr/local/bin/


# cd /etc
# pcf2vpnc /path/username.pcf default.conf
# chown root:root default.conf
# chmod 600 default.conf

Edit the config file to either use your username and password, or to manually enter


# nano default.conf
# Uncomment for auto login
# Xauth username myusername
# Xauth password userpass
# Uncomment for manual login
Xauth interactive

Backup resolv.conf

As a final configuration step, it is a good idea to make a backup of your resolv.conf file. The vpnc program will replace the resolv.conf upon connection and will restore it when you disconnect.

Connect and Disconnect

You must be logged in as Root for this to work

# vpnc
# vpnc-disconnect

For cPanel

Main >> System Health >> Show Current CPU Usage
It will show what user is taking most cpu. However, if you suPHP is not installed on your server, you will not able to see username. It will show you just nobody user.

remote ssh

Use “top –c” and nice top to find out the process that is causing high load on the server. Get the process id and then check who owns the process running in the server.

top --c
cd /proc/<process id>
ls -l 

The above command will give the link to the directory from which the script is running. Also try installing suphp in the server.

There are various ways to checkout the processes using high percentage of CPU and RAM, like

1) WHM >> Apache Status : it will show you each request to your website + it’s CPU and RAM usage.
2) ps -auxf : it will list all the current processes running on the server + it’s CPU and RAM usage
3) top c : same as above but shows a real time view of all the processes and resource usage

Load monitoring commands

1)top -c you will see the resource usage in percentage like Memory, CPU etc.Also server load details. And pstree -pua command list the processes in the server.
2) If say a user is listed high in the above command with higher resource usage the command

ls -alh /proc/<id> |grep cwd

Where is the process id of the user. This command gives the working directory of the script.
3) Check WHM interfaces
Main >> Server Status >> Daily Process Log
Main >> Server Status >> Apache Status

Some of the security tips that will help you is :-

1) enable suPHP
2) enable mod_security
3) also close some of the security holes in the php functions using the php disable_functions.

is there any command to show the Users with CPU and Memory usages ?
Use top -c d2 -u “username” as an example top -c d2 -u mylogwp