discarded (system filter)

Hello,

On one of our servers our mail server is blocking some valid emails and in the exim log we see the following:

2017-12-15 14:44:57 1ePqIK-0007YL-Ox <= [email protected] H=host [1.2.3.4] P=esmtps X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=198628 id=OFCEBF2372.91221910-ONC12581F7.004B703F-C12581F7.004B8711@domain.com T="Subject" from <[email protected]> for [email protected]
2017-12-15 14:44:57 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1ePqIK-0007YL-Ox
2017-12-15 14:44:57 1ePqIK-0007YL-Ox => discarded (system filter)
2017-12-15 14:44:57 1ePqIK-0007YL-Ox Completed

How can we further analyze why this is happening? Which filter is blocking this email exactly?

Thanks in advance for your input!

Regards

Have a look here, exactly the same question:
http://forum.directadmin.com/showthread.php?t=46738
or also, depending on your exim version, check your /etc/exim.conf or /etc/system_filter.exim for reasons.

On a first glance.... my guess is the mail was rejected because of an empty subject line.

I have edited the subject for privacy reasons, but the emails do have valid subjects.

The problem is that the logs aren't telling me what's blocking the emails exactly. "discarded (system filter)" is a very generic message and it's a bit like looking for a naald in een hooiberg

Ja ik heb ook al eens last gehad van dat naaldzoeken.

You didn't fine any clues in the system_filter.exim or exim.pl file? Because as far as I know only those cause system filter messages.
You could try to temporary disable the system filter in exim.conf by marking it like:
and restart exim?

Then retry and see if that works or if that maybe trows some other error messages.

Just to be sure, which version of exim, exim.conf and exim.pl are you using?