Forem: Cahit Bodur

How to Analyze SMTP Logs and Extract Email Traffic (PHP Script)

Cahit Bodur — Sat, 28 Mar 2026 19:04:27 +0000

Working with mail servers? Then you already know one thing:

👉 SMTP logs are messy.

When a client asks:

“Can you send me only my email logs?”

You’re stuck with a huge log file containing thousands of mixed records.

In this post, I’ll show you a simple but powerful way to extract a specific email’s traffic from SMTP logs using PHP.

🚨 The Problem

SMTP logs are not structured per email.

Instead, they look like this:

SMTP-IN 63EBA13D... 20.57..79 EHLO
SMTP-IN 63EBA13D... 20.57..79 MAIL FROM
SMTP-IN 63EBA13D... 20.57..79 RCPT TO:user@example.com
SMTP-IN 63EBA13D... 20.57..79 DATA

👉 Different emails are mixed together
👉 Same IP continues the flow
👉 Logs are split across multiple lines

So filtering by email alone is not enough.

💡 The Solution

Here’s the trick:

Find the line containing the target email
Extract the IP address from that line
Collect nearby lines with the same IP

This reconstructs the full SMTP flow.

⚙️ PHP Script

<?php

$logFile = __DIR__ . "/log/SMTP-Activity.log";
$outputFile = __DIR__ . "/log/output.log";

$targetMail = "user@example.com";
$range = 100;
$excludeIp = "185.86.*.14";

$lines = file($logFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
$total = count($lines);

$out = fopen($outputFile, "w");

for ($i = 0; $i < $total; $i++) {

    if (stripos($lines[$i], $targetMail) !== false) {

        $parts = preg_split('/\t+/', $lines[$i]);
        $ip = trim($parts[4] ?? '');

        if (!$ip || $ip === $excludeIp) continue;

        $start = max(0, $i - $range);
        $end   = min($total - 1, $i + $range);

        fwrite($out, $lines[$i] . "\n");

        for ($j = $start; $j <= $end; $j++) {

            $p = preg_split('/\t+/', $lines[$j]);
            $currentIp = trim($p[4] ?? '');

            if ($currentIp === $excludeIp) continue;

            if ($currentIp === $ip) {
                fwrite($out, $lines[$j] . "\n");
            }
        }

        fwrite($out, "\n\n");
    }
}

fclose($out);

echo "Done!";
?>

📌 What You Get
Full SMTP flow for a specific email
Clean, client-ready log output
Faster debugging & analysis
🎯 Use Cases
Extract logs for a specific client
Debug email delivery issues
Detect brute-force login attempts
Analyze spam behavior
🔗 Full Tutorial (Detailed Explanation)

If you want a step-by-step explanation with real examples:

👉 https://sizinsayfaniz.com/blog2/Kurumsal-Mail-Sunuculari-Icin-Php-Log-Analizi.html

💻 GitHub Repository

👉 https://github.com/cahit2834/smtp-log-analiz-php

⚡ Final Thoughts

SMTP logs look chaotic, but with the right approach, you can extract meaningful insights easily.

If you're managing a mail server, this method will save you hours.

⭐ If this helped you, consider starring the repo!

Asterisk recording file wav to mp3

Cahit Bodur — Tue, 17 Feb 2026 08:26:11 +0000

function dosya_uzanti_oku($dosya_adi) {
return substr(strrchr($dosya_adi,'.'),1);
}

$sayi=0;
$conn =  @mysqli_connect(dbhost, dbuser, dbpass, dbnamecdr);
$GLOBALS["db"] =  @mysqli_connect(dbhost, dbuser, dbpass, dbnamecdr);
$sql = "SELECT * FROM  cdr where 
CHAR_LENGTH(recordingfile)>2 and recordingfile LIKE '%.wav'       
order by calldate 
desc Limit 0,500";
$result = @mysqli_query($db, $sql); 
while($row = @mysqli_fetch_assoc($result)) 
{

$tarih=$row[calldate];
$tarih = explode('-',$tarih);
$gun=$tarih[2];
$gun= explode(' ',$gun);

$recordingfile=$row["recordingfile"];
$kontrol=dosyakontrol($recordingfile,"/var/");  
        $dosyaadi='recording/'.$tarih[0].'/'.$tarih[1].'/'.$gun[0].'/'.$row['recordingfile'];
//echo $dosyaadi;echo "<br>";

if($kontrol=="var")
{                   $dosyaadi=dosyacevir($row["recordingfile"]);                    $uzanti=dosya_uzanti_oku("$dosyaadi");
echo $uzanti;
$dosyaboyutham= round(filesize("$dosyaadi"));
$dosyatarih =$row[recordingfile];
$dosyatarih = explode('/',$dosyatarih);
$dosyaadikaydedilecek=wavmp3($dosyatarih[8]);               $dosyaadifile='recording/'.$tarih[0].'/'.$tarih[1].'/'.$gun[0].'/'.$dosyaadikaydedilecek;
if($uzanti=="wav" and $dosyaboyutham>1)
{
echo $sayi; echo " ";
echo $dosyaadi;
echo $dosyaadifile;
echo "-+-";
echo $dosyaadikaydedilecek;
echo "<br><br>";

exec( "lame --cbr -b 12k $dosyaadi $dosyaadifile" ,$output, $return);
if (!$return) {
$sqld = "UPDATE cdr
SET recordingfile='$dosyaadikaydedilecek'  WHERE recordingfile='$recordingfile'";   
if ($GLOBALS["db"]->query($sqld) === FALSE) {
echo "Error: " . $sqld . "<br>" . $GLOBALS["db"]->error;}unlink("$dosyaadi");
} else {
echo "cevrilemedi";
}               
}

}else{
$uzanti=dosya_uzanti_oku("$dosyaadi");
//echo $uzanti;
$dosyaboyutham= round(filesize("$dosyaadi"));               $dosyaadikaydedilecek=wavmp3($row['recordingfile']);            $dosyaadifile='recording/'.$tarih[0].'/'.$tarih[1].'/'.$gun[0].'/'.$dosyaadikaydedilecek;
if($uzanti=="wav" and $dosyaboyutham>1)
{
echo $sayi; echo " ";
echo $dosyaadi;
echo $dosyaadifile;
echo "---";
echo $dosyaadikaydedilecek;
echo "<br><br>";
exec( "lame --cbr -b 12k $dosyaadi $dosyaadifile" ,$output, $return);
if (!$return) {
$sqld = "UPDATE cdr
SET recordingfile='$dosyaadikaydedilecek'  WHERE recordingfile='$recordingfile'";   
if ($GLOBALS["db"]->query($sqld) === FALSE) {
echo "Error: " . $sqld . "<br>" . $GLOBALS["db"]->error;}
unlink("$dosyaadi");
} else {
echo "cevrilemedi";
}

}
}
$sayi=$sayi+1;  
}
echo "<br>---<br>";
$conn =  @mysqli_connect(dbhost, dbuser, dbpass, dbnamecdr);
$GLOBALS["db"] =  @mysqli_connect(dbhost, dbuser, dbpass, dbnamecdr);
$sql = "SELECT * FROM  cdr  where CHAR_LENGTH(recordingfile)<2   and  calldate>'$bugun' and calldate<'$yarin' 
order by calldate 
desc Limit 0,500";
$result = @mysqli_query($conn, $sql);   
while($row = @mysqli_fetch_assoc($result))  {
$recordingfile="";
$uni=$row["uniqueid"];
$sql2 = "SELECT * FROM cdr where    
CHAR_LENGTH(recordingfile)>2 and uniqueid='$uni'  and  calldate>'$bugun' and calldate<'$yarin'        
order by calldate 
desc Limit 0,1";
$result2 = @mysqli_query($conn, $sql2); 
$row2 = @mysqli_fetch_assoc($result2);

echo $row["src"];
echo " - ";
echo $row["uniqueid"];
echo " - ";
echo $row2["recordingfile"];
$recordingfile=$row2["recordingfile"];          
         $kayitguncelle=guncelle("cdr","recordingfile='$recordingfile'","uniqueid='$uni' and  calldate>'$bugun' and calldate<'$yarin'   ");
echo "<br>";
}

issabel pbx calls recording files wav to mp3 convertor
The code I use to fix file directory errors in SQL call logs requires LAME to be installed; you can set it to run every 15 minutes in the scheduled tasks.

buyatek sizinsayfaniz.com

Classic ASP Sending emails from your own server.

Cahit Bodur — Wed, 04 Feb 2026 19:57:48 +0000

Benim gibi eski classic asp kullananlar için, kendi mail sunucularını kullanarak sitelerinden mail gönderebilmeleri için gerekli kodlar.

Dim iMsg, iConf, Flds

Set iMsg = CreateObject("CDO.Message")
Set iConf = CreateObject("CDO.Configuration")
Set Flds = iConf.Fields

schema = "http://schemas.microsoft.com/cdo/configuration/"
Flds.Item(schema & "sendusing") = 2
Flds.Item(schema & "smtpserver") = "mail.sunucuadresiniz.com" 
Flds.Item(schema & "smtpserverport") = 587
Flds.Item(schema & "smtpauthenticate") = 1
Flds.Item(schema & "sendusername") = "info@kendimailadresiniz.com"
Flds.Item(schema & "sendpassword") =  "mailsifreniz"
Flds.Item(schema & "smtpusessl") = 0

Flds.Update

With iMsg

.To = "mailgönderilicekadres@adres.com" 
.From = "info@kendimailadresiniz.com"
.Subject = "Mail Konusu"
.HTMLBody = body
.Sender = "info@kendimailadresiniz.com"
.Organization = ""
.ReplyTo = "info@kendimailadresiniz.com"

.Server = "mail.sunucuadresiniz.com" 
.Username = "info@kendimailadresiniz.com"
.Password =  "mailsifreniz"

Set .Configuration = iConf
SendEmailGmail = .Send
End With

set iMsg = nothing
set iConf = nothing
set Flds = nothing

Detaya ihtiyacınız olursa bloğumdaki yazıyıda kontrol edebilirsiniz.
https://sizinsayfaniz.com/blog2/Classic-Asp-Ile-Kurumsal-Mail-Adresinizden-Mail-Gondermek.html