Getting Gateway Hostnames from Mail Logs

Luke Hebert

- One minute read - 203 words

When a relay access denied message floods your exim log, the IP address alone rarely tells you which upstream gateway or customer is responsible. Resolving those IPs to hostnames gives you a concrete name to track down the misconfiguration.

The Command

for ip in $(grep 'Relay access denied' /var/log/exim_mainlog | grep -oP '(?<=\[).*?(?=\])' | sort | uniq); do host "$ip"; done

How It Works

  1. grep 'Relay access denied' filters the exim main log for relay denial events.
  2. grep -oP '(?<=\[).*?(?=\])' extracts the IP address sitting between the square brackets that exim uses to log the remote host.
  3. sort | uniq removes duplicates so you only resolve each address once.
  4. host "$ip" performs a reverse DNS lookup, returning the PTR record (hostname) for each IP.

Tips

  • If the log is rotated, point the first grep at the relevant file (for example /var/log/exim_mainlog.1) or use zgrep against a compressed archive.
  • Some IPs will return not found from host. That usually means the remote side has no PTR record, which is itself a useful data point when you escalate the issue.
  • Wrap the whole thing in a script and add a date header so you can timestamp the output for your ticket or change log.