exim main logs file locations:
/var/log/exim_mainlog
/var/log/exim_mainlog.1.gz
/var/log/exim_mainlog.2.gz
/var/log/exim_mainlog.3.gz
/var/log/exim_mainlog.4.gz

Find successful mail from an address:
for i in $(grep FROM_ADDRESS /var/log/exim_mainlog|grep “<=” | awk {‘print $3’}); do grep $i /var/log/exim_mainlog; done

for i in $(zgrep FROM_ADDRESS /var/log/exim_mainlog.*|grep “<=” | awk {‘print $3’}); do zgrep $i /var/log/exim_mainlog.*; done

Find successful mail from an address, to another address:

for x in $(for i in $(grep FROM_ADDRESS /var/log/exim_mainlog|grep “<=” | awk {‘print $3’}); do grep $i /var/log/exim_mainlog; done|grep TO_ADDRESS |grep “=>”| awk {‘print $3’}); do grep $x /var/log/exim_mainlog; done

for x in $(for i in $(zgrep FROM_ADDRESS /var/log/exim_mainlog.*|grep “<=” | awk {‘print $3’}); do zgrep $i /var/log/exim_mainlog.*; done|grep TO_ADDRESS |grep “=>”| awk {‘print $3’}); do zgrep $x /var/log/exim_mainlog.*; done

Find successful mail to an address:
for i in $(grep TO_ADDRESS /var/log/exim_mainlog|grep “=>” | awk {‘print $3’}); do grep $i /var/log/exim_mainlog; done

for i in $(zgrep TO_ADDRESS /var/log/exim_mainlog.*|grep “=>” | awk {‘print $3’}); do zgrep $i /var/log/exim_mainlog.*; done

Find successful mail to an address, from another address:
for x in $(for i in $(grep TO_ADDRESS /var/log/exim_mainlog|grep “=>” | awk {‘print $3’}); do grep $i /var/log/exim_mainlog; done|grep FROM_ADDRESS |grep “<=”| awk {‘print $3’}); do grep $x /var/log/exim_mainlog; done

for x in $(for i in $(zgrep TO_ADDRESS /var/log/exim_mainlog.*|grep “=>” | awk {‘print $3’}); do zgrep $i /var/log/exim_mainlog.*; done|grep FROM_ADDRESS |grep “<=”| awk {‘print $3’}); do zgrep $x /var/log/exim_mainlog.*; done

Find locally-sent messages:
grep “P=local” /var/log/exim_mainlog