OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Postfix maillog output and Logwatch

From: Rob Myroon (rob.myroontartan.ca)
Date: Mon Oct 02 2006 - 13:08:23 CDT


Hello,

I believe that the line of output generated by Postfix when a local user
sends an e-mail is not quite right and then Logwatch cannot parse the
line properly when it is trying to count the number of e-mails sent by
each user. I suspect that it may be because the mail users are in an
openldap directory and not /etc/passwd.

A line of output from postfix when a local user sends an e-mail looks
like this:

Oct 2 11:37:31 explorer2 postfix/qmgr[9096]: 045CF7BC21:
from=<local.usertartan.ca>, size=1317, nrcpt=1 (queue active)

A line of output from postfix when an outside user sends us an e-mail
looks like this:

Oct 2 11:35:59 explorer2 postfix/qmgr[9096]: 730637BC21:
from=<outside.usersomeplace.com>, size=19422, nrcpt=1 (queue active)

They are the same. According to the Logwatch perl script it is looking
for the text "uid=***" before the "from" text. If the "uid" text was
present then logwatch would be able to pick out e-mails sent by local
users. Is the problem that postfix is looking for the uid number in
/etc/passwd but the uid numbers are in the ldap directory?

(This isn't a serious problem but it has been bugging me for a long time.)

redhat es4
postfix 2.2.10
logwatch 7.3.1

Thanks for the help,
Rob