Exim moves mail: it accepts messages from your sites and users, delivers local mail to mailboxes, and talks SMTP to the rest of the internet. Its main log records every message with sender, recipient and how it was submitted.
That log is a goldmine for diagnosing the two classic mail disasters: a spam explosion (who sends, from which script or mailbox, to whom) and deliverability problems. Per-account sent-mail counting and compromised-mailbox detection are both built on reading Exim’s log.
Frequently asked questions
Where does Exim log on a panel server?
Typically /var/log/exim_mainlog (with rotated copies). Each delivery line identifies the sender, the authentication used and the recipients.
What is the difference between Exim and SMTP?
SMTP is the protocol; Exim is a program that speaks it — same relationship as Apache and HTTP.