I have written a small patch to Exim (4.12-4.20) that logs incomplete
SMTP transactions during dictionary attacks or address verification
callbacks from other hosts. I'm not sure if that will be of use to
anybody else, but just in case it's available at
http://www.stud.fernuni-hagen.de/q4408950/exim-4.12-transaction.diff
http://www.stud.fernuni-hagen.de/q4408950/exim-4.14-transaction.diff
http://www.stud.fernuni-hagen.de/q4408950/exim-4.20-transaction.diff
Currently, incomplete transactions will get logged together with SMTP
connections, that means you will have to set "log_selector = [...]
+smtp_connection" for them to make it into the log file.
Andy
- --
Andreas J. Mueller email: <andy@???>
