OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Header logging, revisited
From: Ralf Hildebrandt (R.Hildebrandttu-bs.de)
Date: Sat Apr 01 2000 - 07:36:15 CST

On Fri, Mar 31, 2000 at 11:08:53PM -0600, Michael Schwager wrote:

> 1. I need to log some headers (To:, From:, Subject:).
You could use always_bcc and have a script there (procmail) which extracts
the needed headers. Dead simple.

> 2. We are currently doing that in Sendmail with custom code in the
> source; it's easy there because the entire header is available
> in a struct.
=:)

> 5. Next year they plan to replace our Sun's with Windows 2000
> boxes.
Yes! Management decision time again.

> I see that header logging has been discussed before in this list, and the
> recommended solution was about what Wietse said:
> /etc/postfix/main.cf:
> always_bcc = log-headers
> /etc/aliases:
> log-headers: "|sed '/^$/q' | logger -p mail.info -t headers; exit 0"

Ah. So my guess was quite good :)

> Now, given my concerns about performance, do you think that be a good
> avenue for us? I worry that forking the two processes would be a killer.
> As a matter of fact, we need to be able to correlate the envelope logging
> with the header logging, so I would go ahead and write a perl or C program
> to do the logging instead (thus attempting to extract the Postfix ID). At
> any rate, I think syslog would be much more advantageous... but I'm not
> sure if the savings in overhead would be so great.

I think if you would do delivery using procmail anyway you wouldn't need to
spawn yet another process...
This would eliminate the need for always_bcc, too. 

-- 
Ralf Hildebrandt <R.Hildebrandttu-bs.de> www.stahl.bau.tu-bs.de/~hildeb
Do not meddle in the affairs of sysadmins,
they are quick to anger and have no need for subtlety.