How to Analyze SMTP Logs and Extract Email Traffic (PHP Script)

Working with mail servers? Then you already know one thing:

👉 SMTP logs are messy.

When a client asks:

“Can you send me only my email logs?”

You’re stuck with a huge log file containing thousands of mixed records.

In this post, I’ll show you a simple but powerful way to extract a specific email’s traffic from SMTP logs using PHP.

🚨 The Problem

SMTP logs are not structured per email.

Instead, they look like this:

SMTP-IN 63EBA13D... 20.57..79 EHLO
SMTP-IN 63EBA13D... 20.57..79 MAIL FROM
SMTP-IN 63EBA13D... 20.57..79 RCPT TO:[e-mail]
SMTP-IN 63EBA13D... 20.57..79 DATA

👉 Different emails are mixed together
👉 Same IP continues the flow
👉 Logs are split across multiple lines

So filtering by email alone is not enough.

💡 The Solution

Here’s the trick:

Find the line containing the target email
Extract the IP address from that line
Collect nearby lines with the same IP

This reconstructs the full SMTP flow.

⚙️ PHP Script

<?php

$logFile = __DIR__ . "/log/SMTP-Activity.log";
$outputFile = __DIR__ . "/log/output.log";

$targetMail = "[e-mail]";
$range = 100;
$excludeIp = "185.86.*.14";

$lines = file($logFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
$total = count($lines);

$out = fopen($outputFile, "w");

for ($i = 0; $i < $total; $i++) {

    if (stripos($lines[$i], $targetMail) !== false) {

        $parts = preg_split('/\t+/', $lines[$i]);
        $ip = trim($parts[4] ?? '');

        if (!$ip || $ip === $excludeIp) continue;

        $start = max(0, $i - $range);
        $end   = min($total - 1, $i + $range);

        fwrite($out, $lines[$i] . "\n");

        for ($j = $start; $j <= $end; $j++) {

            $p = preg_split('/\t+/', $lines[$j]);
            $currentIp = trim($p[4] ?? '');

            if ($currentIp === $excludeIp) continue;

            if ($currentIp === $ip) {
                fwrite($out, $lines[$j] . "\n");
            }
        }

        fwrite($out, "\n\n");
    }
}

fclose($out);

echo "Done!";
?>

📌 What You Get
Full SMTP flow for a specific email
Clean, client-ready log output
Faster debugging & analysis
🎯 Use Cases
Extract logs for a specific client
Debug email delivery issues
Detect brute-force login attempts
Analyze spam behavior
🔗 Full Tutorial (Detailed Explanation)

If you want a step-by-step explanation with real examples:

👉 https://sizinsayfaniz.com/blog2/Kurumsal-Mail-Sunuculari-Icin-Php-Log-Analizi.html

💻 GitHub Repository

👉 https://github.com/cahit2834/smtp-log-analiz-php

⚡ Final Thoughts

SMTP logs look chaotic, but with the right approach, you can extract meaningful insights easily.

If you're managing a mail server, this method will save you hours.

⭐ If this helped you, consider starring the repo!