Re: PostFix
MrC <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Hugo van der Kooij wrote:
> Hi,
>
> I made a change to my postfix/mailscanner setup to be more selective on
> the messages I let mailscanner look at.
>
> The downside is that logwatch is unaware and is now seeing lots of
> unknown lines and reports them under the postfix section.
>
> I have a bit of a hard time working out the structure of the postfix
> parser to find the proper place to add some code to just count these lines.
>
Hugo,
The lines below are captured and reported correctly since version
1.36.13pre5, 2007-11-14:
2007-11-14 (version: 1.36.13pre5)
- New: Support for all access(5) actions. See the "Level Limiter
Options" section in the postfix-logwatch(1) man page, and "Common
access control actions" in postfix-logwatch.conf.
$ postfix-logwatch --version
postfix-logwatch: 1.37.01
$ postfix-logwatch --max_report_width 70 maillog.hugo
****** Summary ******************************************************
14 Placed on hold
****** Detail ********************************************************
14 Placed on hold --------------------------------------------
14 Recipient address
10 [email protected]
6 [email protected]
4 194.151.25.147 unknown
2 209.132.177.33 hormel1.redhat.com
2 [email protected]
2 194.151.25.147 unknown
1 3hcYlSAAAD7kev0-ftqtr-nvmdqognmdanx.bnl@calenda...
1 194.151.25.147 unknown
1 [email protected]
1 194.151.25.147 unknown
2 [email protected]
1 [email protected]
1 194.151.25.147 unknown
1 [email protected]
1 194.151.25.147 unknown
1 [email protected]
1 [email protected]
1 194.151.25.147 unknown
1 [email protected]
1 [email protected]
1 194.151.25.147 unknown
Please evaluate the latest version 1.37.01:
http://www.mikecappella.com/logwatch
MrC
> For now I wrote a single line to just dump them:
>
> - --- postfix-SHIPPED 2007-05-20 02:24:33.000000000 +0200
> +++ postfix 2008-05-14 07:45:32.000000000 +0200
> @@ -688,6 +688,7 @@
> ~ # more from mail.info level and above
> ~ or ( $p1 =~ m/^read from [a-f\d]{8}/ )
> ~ or ( $p1 =~ m/^write to [a-f\d]{8}/ )
> + or ( $p1 =~ /Recipient address triggers HOLD action;/ ) # Hold
> action for MailScanner.
>
> ~ );
>
>
> ~ **Unmatched Entries**
> ~ 1 May 10 15:55:46 balin postfix/smtpd[6843]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action;
> from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 18:00:13 balin postfix/smtpd[3231]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action;
> from=<3hcYlSAAAD7kev0-ftqtr-nvmdqognmdanx.bnl@calendar-server.bounces.google.com>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 15:59:10 balin postfix/smtpd[6843]: NOQUEUE: hold:
> RCPT from hormel1.redhat.com[209.132.177.33]:
> <[email protected]>: Recipient address triggers HOLD action;
> from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<hormel.redhat.com>
> ~ 1 May 10 11:02:52 balin postfix/smtpd[21134]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action; from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 03:10:43 balin postfix/smtpd[2921]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action;
> from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 15:51:41 balin postfix/smtpd[6843]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action;
> from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 12:43:36 balin postfix/smtpd[10461]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action; from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 20:56:57 balin postfix/smtpd[4082]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action; from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 19:43:48 balin postfix/smtpd[28037]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action; from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 15:55:52 balin postfix/smtpd[7140]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action;
> from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 15:54:23 balin postfix/smtpd[12052]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action;
> from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 23:27:27 balin postfix/smtpd[4354]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action; from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 19:28:27 balin postfix/smtpd[28037]: NOQUEUE: hold:
> RCPT from unknown[194.151.25.147]: <[email protected]>: Recipient
> address triggers HOLD action; from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<asterix.spamvrij.net>
> ~ 1 May 10 15:58:16 balin postfix/smtpd[12052]: NOQUEUE: hold:
> RCPT from hormel1.redhat.com[209.132.177.33]:
> <[email protected]>: Recipient address triggers HOLD action;
> from=<[email protected]>
> to=<[email protected]> proto=ESMTP helo=<hormel.redhat.com>
>
> - --
> [email protected] http://hugo.vanderkooij.org/
> PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc
>
> A: Yes.
> >Q: Are you sure?
> >>A: Because it reverses the logical flow of conversation.
> >>>Q: Why is top posting frowned upon?
>
> Bored? Click on http://spamornot.org/ and rate those images.
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
>
> iD8DBQFIKn0IBvzDRVjxmYERAnaQAKCloKqAEjZqASlfMd/5HDZ+IGcPJQCePW/Y
> /FD7LLvuM8khF0ZX0eWl7DI=
> =pGEi
> -----END PGP SIGNATURE-----
> _______________________________________________
> Logwatch-Devel mailing list
> [email protected]
> http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel