The log file will have the logging format like this:
/var/log/filter.log
2006-05-10 12:05:13 1Fds7S-0002Sa-MV from
smooth595@gmail.com contained spam keywords
2006-05-10 14:18:47 1FduCn-0006GV-1r from
dayton.nowellu7xn@gmail.com contained spam keywords
2006-04-27 15:44:35 1FZDLn-0005Mo-5z from
nobody@ocean.wavepointmedia.com is fraud
2006-04-27 16:37:40 1FZEB9-0002KQ-VP from
nobody@ocean.wavepointmedia.com is phishing
Date and time, the Exim message ID, the sender and the section of the filter, like phishing, fraud or spam. You can check the mail message by grepping the exim_mainlog for it like this
grep 1FZEB9-0002KQ-VP /var/log/exim_mainlog
If you haven’t already you should enable a higher level of logging in your mail server which will be in our next tutorial.