How do I get a SMTP session log in Exim?

You can easily look at the commands received from the remote system with a few ACL additions:

# Global hosts setting, list of IP addresses you want to see SMTP commands
hostlist debug_hosts = xxx.xxx.xxx.xxx : yyy.yyy.yyy.yyy

# early in acl_smtp_helo
warn hosts     = +debug_hosts
     log_write = DEBUG: $smtp_command

# early in acl_smtp_mail
warn hosts     = +debug_hosts
     log_write = DEBUG: $smtp_command

# early in acl_smtp_rcpt
warn hosts     = +debug_hosts
     log_write = DEBUG: $smtp_command

But if you want to see in the logs what your side is saying too, that's not possible inside exim. Your options are then constrained to any system provided network debugging tools, such as tcpdump, tshark, or (my favorite) ngrep.

As an example, if you have a customer who complains they cannot send mail through your server. Here's a simple entry that shows why they are unable to send:

# ngrep -q port 25 host 208.54.85.254
<snip>
T 208.54.85.254:15084 -> 208.89.138.22:25 [AP]
  AUTH PLAIN kkvdsoirDSAasdfrASDF4swSD23DAGAG6893Mgss==..                            

T 208.89.138.22:25 -> 208.54.85.254:15084 [AP]
  535 Incorrect authentication data..

I hope that one of these proves to be useful for you.


Possibly not what you're after, but wireshark / tshark is great for this. On the command line:

tshark -w exim.pcap -i <interface> host <target IP>

Then open the file in Wireshark and you can peruse the whole SMTP conversation at your leisure: Right-click on one matching packet and select 'View TCP Conversation'.

If you want to see it as it happens, just omit the -w argument from the above, though that can be pretty spammy with large emails.