OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Status of Pflogsumm Maintenance

From: Victor Duchovni (Victor.Duchovnimorganstanley.com)
Date: Tue May 27 2008 - 12:42:35 CDT


On Mon, May 26, 2008 at 08:49:06AM -0400, Jim Seymour wrote:

> It's true I'm not currently active in the "Postfix community." And it's
> true I'm not much inclined to add *enhancements* to Pflogsumm, lately.
> But I *do* plan to keep Pflogsumm functional. After all: I use
> Pflogsumm myself ;), and I do eventually upgrade my Postfix
> installation. So if the logfile format, as emitted by Postfix,
> changes, somebody please let me know, perhaps send me some logfile
> entries, maybe even a suggested patch (for which you'll get credit, if
> I use it) and I'll make sure Pflogsumm remains useful.

The log format has not changed, but this is an edge case, "long" entries
get truncated, and may not include content usually expected at the
end of similar "short" entries.

In particular,

        postfix/smtp[12345]: id: to=<...>, ... (host foo said: ...

may not end with the expected number of ")" characters or include some
or all of the (in reply TO ...) context.

    2008-05-27T13:00:29-0400 amnesiac postfix/smtp[2862]: 5A2654802E:
    to=<XXXXXXXXXXXXXXXXXX.XXXXXXXXXXXXXXXXXXXXX.XXXalerts.bounces.google.com>,
    relay=alt1.gmr-smtp-in.l.google.com[209.85.147.14]:25, delay=227374,
    delays=227372/0/1.6/0.2, dsn=4.7.0, status=deferred
    (host alt1.gmr-smtp-in.l.google.com[209.85.147.14] said:
    421 4.7.0 Try again later, closing connection. (MAIL) k36si112137800waf.0
    (in reply to MAIL FROM command))

If the log entry were longer (1-2K in size), it could be truncated somewhere
after "said:" and before the final "))".

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.