OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Accessing a mail's queue id from pipe daemon

From: Victor Duchovni (Victor.DuchovniMorganStanley.com)
Date: Wed Apr 05 2006 - 10:18:12 CDT

On Wed, Apr 05, 2006 at 04:37:20PM +0200, Jan P. Kessler wrote:

> Ideal would be s.th. like " flags=Rq user=spamfilter
> argv=/usr/local/spamassassin/bin/spamfilter.sh -f $(sender) --
> $(recipient) -- $(queueid)". The intention is to add the old queue id to
> the message header before passing the mail to the spamc client.

The old queue id is already in the Received: headers. Furthermore with
SMTP proxy content filters (that forward the remote "." response to
the pre-filter SMTP client), the correlation is already logged:

    2006-04-05T10:55:26-0400 pimtabh2 postfix-pre/smtp[4132]: 3556FC40009:
            to=<recipientexample.com>, relay=127.0.0.1[127.0.0.1]:255,
        delay=0.32, delays=0.05/0/0.08/0.19, dsn=2.0.0, status=sent
        (250 2.0.0 Ok: queued as 5D3C740007)

    2006-04-05T10:55:26-0400 pimtabh2 postfix-post/smtp[4154]: 5D3C740007:
            to=<recipientexample.com>, relay=mailhub.example.com[192.0.2.1]:25,
        conn_use=75, delay=0.35, delays=0.15/0/0.01/0.19, dsn=2.0.0,
        status=sent (250 2.0.0 k35EtQN20060 Message accepted for delivery)

This shows the pre-filter queue-id "3556FC40009" becoming a post-filter
queue-id of "5D3C740007", and even the queue id for that other MTA
downstream.

> that it will be easy to create a relation between INCOMING and OUTGOING
> queue ids which would simplify our logfile analysis. Unfortunately that
> does not seem to be implemented ("man 8 pipe", Postfix 2.2.8). Does
> anybody have an idea for me?

Look at the top-most received header. It will contain the queue id from
the pre-filter instance. Arrange to somehow log this with the downstream
queue id.

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.