OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: log analysis tool

From: Leonardo Rodrigues Magalhães (leolistassolutti.com.br)
Date: Sat Oct 02 2004 - 08:17:44 CDT


    Hmmm ..... a ridiculous easy and still efficient solution ???? i liked
that :)

    Thanks for the tip, i'll try that today !!!

    Sincerily,
    Leonardo Rodrigues

----- Original Message -----
From: "John Groseclose" <iaincaradoc.org>
To: <postfix-userscloud9.net>
Sent: Saturday, October 02, 2004 9:06 AM
Subject: Re: log analysis tool

At 9:13 AM -0300 10/2/04, Leonardo Rodrigues Magalhães wrote:
> Hello Guys,
>
> We have several great tools for analysing postfix logs. But I've
> searched, found several people with the same problem and couldnt find an
> answer.
>
> Is there ANY tool for analysing postfix logs that can deal with the
> 'doubled message' problem that happens when amavisd is used ? I couldnt
find
> any answer neither solution for this .....

There's one solution that I've been using with good results...

Instead of having amavisd listen on 127.0.0.1, I set up another 127.0.0.x
address.

I've got that address in header checks with a directive to IGNORE any line
with that 127.0.0.x address in it.

When I run pflogsumm, I just grep -v 127.0.0.x and pipe the output through
pflogsumm, and it tosses out all of those extraneous lines. The results are
close enough that I'm not worried about them.