Skip to main content

Monitoring Exim

Exim is recognised by its exim4 process, the binary name Debian and Ubuntu install, and watched through the commands the daemon itself answers: the queue count, the version, and the location of its main log. Nothing is configured on your side.

How Exim is recognised​

The signed definition matches a host running a process named exim4. A build that runs as plain exim is not matched today; the limitations below say so. Once matched, every 60 seconds the agent dials port 25, runs exim4 -bpc for the number of queued messages, exim4 -bV for the version, and exim4 -bP log_file_path to learn where the logs go. In the log definition Exim's %s placeholder is resolved to main, so a /var/log/exim4/%slog setting points at the mainlog the agent follows.

What is collected​

Queue. exim4 -bpc prints a single number, the messages sitting in the spool. The agent records it every minute.

Port 25. A connection to 127.0.0.1:25 has to be accepted. A port held by Exim that never completes the accept is reported as "the port is bound but the service is not accepting connections", not as closed.

Facts shown on the host page: version and the main log path.

SignalMetric
Queued messagessvc.exim.queue

Names, tags and units are in the metrics reference.

Logs. The main log ships from the path Exim reported, falling back to /var/log/exim4/mainlog and /var/log/exim/mainlog when the daemon did not answer. Exim's main log carries no per-line severity, so every line is filed at notice and ships by default; the volume guards described in Logs apply as they do everywhere.

Alerts out of the box​

RuleFires whenSeverityShips
Mail queue backlog200 or more queued messages for 15 minuteswarningon

Deferrals are normal: a greylisting peer or a slow remote parks messages that drain on their own, which is why the rule waits fifteen minutes before opening and closes only once the queue is back under 100. Two hundred held that long means deliveries are not leaving. Postfix carries the same numbers, so a mixed setup gets one behaviour. Thresholds and hysteresis are in the rules catalog.

When a path is not where Exim says it is​

The main log path comes from exim4 -bP log_file_path. To point the agent elsewhere:

sudo wakora --set exim.log-path=/var/log/exim4/mainlog

Keys are listed in Agent configuration.

Limitations​

  • Only the exim4 binary name is matched. A daemon running as exim is not recognised.
  • Delivery outcomes are not counted: unlike Postfix there are no sent, deferred or bounced rates, only the queue length.
  • exim4 -bpc counts every message in the spool; frozen messages are not told apart from messages still being retried.
  • Only port 25 is probed; submission ports are not checked.
  • The reject log and the panic log are not shipped, and eximstats-style reports are not produced.