need to find when an email was sent

keat63

Well-Known Member
Nov 20, 2014
1,933
268
113
cPanel Access Level
Root Administrator
I'm trying to determine, when a PHP script may have sent an email to a customer.
Are there any scripts I could run to search for his email address across multiple log files ?

I'm quite possibly looking at something which may have happened 4 months ago, and i don't see any mail logs going back this far, unless there are any archives.

I have the IP address of the device which initiated the PHP file, so if there's anything i could use to search for this, may help.
 
Last edited:

madmanmachines

Well-Known Member
Nov 28, 2014
94
4
8
cPanel Access Level
Root Administrator
Hi,

What do you have to go off? Do you have the email? If so, locate the exim id from the headers(e.g. 1ZsAqY-0000jk-3r). Use this to search as below:
Code:
 zgrep exim-message-id /var/log/exim_mainlog*
If you don't have the message id, I would recommend searching by the current working directory of where the mail script is located. If the script was at '/home/bob/mailscript.php' then:
Code:
zgrep -A1 "cwd=/home/bob" /var/log/exim_mainlog*
Thanks,
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,903
2,237
463
Hello :)

It depends on how far back your Exim logs go. You can search for the email address in /var/log/exim_mainlog and any archives of this log file with a command such as:

Code:
exigrep [email protected] /var/log/exim_mainlog*
Thank you.