OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: not logging "from=" in maillog
From: Wietse Venema (wietseporcupine.org)
Date: Mon Oct 09 2000 - 08:24:00 CDT

As I wrote before, qmgr is a long-running process (as is the master).

All other Postfix processes come into existence on demand. So if
something changes on your machine, like perhaps the syslog socket,
only the new processes will pick up the change.

That's all the advice I have for now. Normally, qmgr happily logs
its thing day after day after day.

        Wietse

Phil N:
> Interestingly, any rejected messages are getting their from= line logged. I
> checked the main.cf file last Wed and restarted the Postfix system at that
> time - "just in case". I have had problems in the past with syslog failing to
> log messages, but when that was the case, ALL syslog messages were lost not
> just some. In any case, I restart syslog and klog every morning at 0400 so
> that I don't have this problem.
>
> I have a backup mail server which is doing the same thing, see the snippet
> following.... FWIW I am using snapshot-20000531
>
> Phil
>
>
> [rootmail1 log]# tail -n 5000 maillog |grep from=
> Oct 8 15:42:14 dns2 postfix/smtpd[15515]: reject: RCPT from
> unknown[151.196.219.30]: 553 <davewendys.com>: Recipient address rejected:
> User not in Public Address Book; from=<veralitewe.com> to=<davewendys.com>
> Oct 8 16:00:52 dns2 postfix/smtpd[15587]: reject: RCPT from
> unknown[63.24.149.82]: 554 Service unavailable; [63.24.149.82] blocked using
> dul.maps.vix.com, reason: See <URL:http://mail-abuse.org/dul/>;
> from=<merchantnycmail.com> to=<labunwendys.com>
> Oct 8 16:02:30 dns2 postfix/smtpd[15591]: reject: RCPT from
> unknown[62.232.13.5]: 553 <davewendys.com>: Recipient address rejected: User
> not in Public Address Book; from=<f-a-r-mhotmail.com> to=<davewendys.com>
>
> [rootmail2 log]# tail /maillog
> Oct 9 05:18:53 dns1 postfix/smtpd[16888]: connect from
> unknown[63.166.116.138]
> Oct 9 05:18:54 dns1 postfix/smtpd[16888]: 0DF181B666:
> client=unknown[63.166.116.138]
> Oct 9 05:18:54 dns1 postfix/cleanup[16889]: 0DF181B666:
> message-id=<116155639Xmail2.emazingdirect.net>
> Oct 9 05:18:54 dns1 postfix/smtpd[16888]: disconnect from
> unknown[63.166.116.138]
> Oct 9 05:18:54 dns1 postfix/smtp[16891]: 0DF181B666:
> to=<sandy_ironswendys.com>, relay=dublns03.wendysi.com[216.87.144.157],
> delay=0, status=sent (250 Message received OK.)
>
>
>
> > Phil N:
> > > For some reason, beginning in in late Sept, I no longer am getting the "from="
> > > line in my maillog. As you can see in the following examples, on 9/12 I was
> > > getting them but by 10/1 I wasn't (generally speaking since an occasional
>
> > Well something has changed. Perhaps it bad hardware. The qmgr
> > daemon is a long-running process - it sits in memory until you stop
> > or restart Postfix.
>
>
>