OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Header logging, revisited
From: Craig Sanders (castaz.net.au)
Date: Sat Apr 01 2000 - 01:03:09 CST

On Fri, Mar 31, 2000 at 11:08:53PM -0600, Michael Schwager wrote:

> 5. Next year they plan to replace our Sun's with Windows 2000
> boxes.

i'm not sure whether to laugh my head off at the hilarious joke or
recoil in horror at the stupidity of management. please tell me it's
a joke, they're not really gonna replace your nice sun boxes with
solid-state drives with some crappy pcs running W2K, are they?

> I see that header logging has been discussed before in this list, and the
> recommended solution was about what Wietse said:
> /etc/postfix/main.cf:
> always_bcc = log-headers
> /etc/aliases:
> log-headers: "|sed '/^$/q' | logger -p mail.info -t headers; exit 0"
>
> Now, given my concerns about performance, do you think that be a good
> avenue for us? I worry that forking the two processes would be a killer.

you could write a perl script to do the logging but instead of using
#!/usr/bin/perl, use #!/usr/bin/speedy

speedyCGI is a way of running persistent perl processes. it is a wrapper
around perl, that forks and kills extra persistent processes as required
by load. the first time the script is run, it is compiled as usual...but
the process doesn't exit when it is finished, it hangs around to handle
the next request. each run still has the overhead of forking the
/usr/bin/speedy wrapper, but not the overhead of starting up the full
perl interpreter and compiling the script.

it's normally used for doing persistent CGI scripts, but i've found it
useful for other tasks as well.

the SpeedyCGI home page is at http://www.daemoninc.com/SpeedyCGI/

it's free software, licensed under the GNU GPL.

another alternative that would do a similar job, but without needing
to compile speedy and without needing to fork any extra processes, is
for the log-headers alias to send the message to a named pipe. have a
perl or whatever process running which monitors the pipe and logs the
headers. just an idea, dunno if it would work.

> As a matter of fact, we need to be able to correlate the envelope
> logging with the header logging,

you should be able to extract the postfix queue ID from the Received
headers.

> so I would go ahead and write a perl or C program to do the logging
> instead (thus attempting to extract the Postfix ID).

perl's File::Tail module is very useful for monitoring the mail log -
it automatically handles the log file being rotated or truncated...you
just open a filehandle with File::Tail and let it worry about the
transitions.

craig 

--
craig sanders