I'm not sure which logfile logwatch is grabbing its lines from. This is from /var/log/exim4/mainlog
2013-05-15 06:25:45 1UcLn6-0007YJ-Ub <= r...@ertos.nicta.com.au H=(duvel.ertos.n icta.com.au) [2402:1800:4000:1:223:7dff:fe5f:1a36] P=esmtp S=10827 id=E1UcLmZ-00 04nr...@duvel.ertos.nicta.com.au 2013-05-15 06:25:46 1UcLn6-0007YJ-Ub => disy.logwa...@cse.unsw.edu.au R=smarthos t T=remote_smtp_smarthost H=lemon.gelato.unsw.edu.au [2402:1800:0:11::5:20] X=TL S1.0:RSA_AES_256_CBC_SHA1:32 DN="CN=lemon.gelato.unsw.edu.au" 2013-05-15 06:25:46 1UcLn6-0007YJ-Ub Completed -- Dr Peter Chubb peter.chubb AT nicta.com.au http://www.ssrg.nicta.com.au Software Systems Research Group/NICTA -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org