Fwd: Improved regex for postfix "connection lost"

Looks like the mailing list is back online, but I am still having
intermittent server problems (looks like bad RAM)... please see this
patch below.


---------- Forwarded message ----------
From: Alvaro Herrera <[email protected]>
Date: Sat, Jun 7, 2008 at 3:53 PM
Subject: Improved regex for postfix "connection lost"
To: [email protected]


Hi Kirk,

I tried to submit a patch for logwatch, but the -patches address
bounced.  Is the project dead?

I attach the patch again in this email, just in case you're in a
position to apply it.  Sadly, both the website and the anon CVS server
seem dead.

Mail Delivery Subsystem wrote:
> The original message was received at Sat, 7 Jun 2008 15:20:06 -0700
> from 190-95-19-91.bk17-dsl.surnet.cl [190.95.19.91]
>
>    ----- The following addresses had permanent fatal errors -----
> <[email protected]>
>     (reason: 550 5.1.1 <[email protected]>... User unknown)
>
>    ----- Transcript of session follows -----
> ... while talking to mail.logwatch.org.:
> >>> DATA
> <<< 550 5.1.1 <[email protected]>... User unknown
> 550 5.1.1 <[email protected]>... User unknown
> <<< 503 5.0.0 Need RCPT (recipient)

> Reporting-MTA: dns; lists.commandprompt.com
> Received-From-MTA: DNS; 190-95-19-91.bk17-dsl.surnet.cl
> Arrival-Date: Sat, 7 Jun 2008 15:20:06 -0700
>
> Original-Recipient: rfc822;[email protected]
> Final-Recipient: RFC822; [email protected]
> Action: failed
> Status: 5.1.1
> Remote-MTA: DNS; mail.logwatch.org
> Diagnostic-Code: SMTP; 550 5.1.1 <[email protected]>... User unknown
> Last-Attempt-Date: Sat, 7 Jun 2008 15:20:12 -0700

> From: Alvaro Herrera <[email protected]>
> To: [email protected]
> Date: Sat, 7 Jun 2008 18:19:04 -0400
> Subject: Improved regex for postfix "connection lost"
> Message-ID: <[email protected]>
>
> Hi,
>
> I've been using logwatch for a while and it's very good.  Many thanks
> for it.
>
> I noticed that in Debian testing's current package of Logwatch I have a
> lot of unmatched Postfix log lines.  I patched the postfix filter to
> detect them -- the problem is that it's now reporting the number of
> bytes that have flowed in the connection after establishing it.  A
> couple of sample lines from my log:
>
> Jun  2 04:34:12 perhan postfix/smtpd[22098]: lost connection after DATA (0 bytes) from unknown[88.230.241.137]
> Jun  2 05:20:02 perhan postfix/smtpd[22185]: lost connection after DATA (0 bytes) from p54AC207F.dip0.t-ipconnect.de[84.172.32.127]
> Jun  7 05:16:54 perhan postfix/smtpd[6297]: timeout after DATA (0 bytes) from unknown[85.102.182.31]
>
> Perhaps it would make sense to distinguish "lost connection after
> CONNECT" (which does not carry the "(X bytes)" thing) from the lost
> connection after DATA.  I decided that it's more trouble than it's
> worth.
>
> The patch is attached.  I noticed that I'm patching postfix rev 1.35
> which is about a year old, so perhaps it's already been fixed, but the
> site is currently down so I can't check.
>
> Agains, thanks for the whole thing.
>
> --
> Alvaro Herrera                  http://www.amazon.com/gp/registry/5ZYLFMCVHXC
> "All rings of power are equal,
> But some rings of power are more equal than others."
>                                  (George Orwell's The Lord of the Rings)

> --- postfix.orig      2008-06-07 18:16:25.000000000 -0400
> +++ postfix   2008-06-07 18:06:34.000000000 -0400
> @@ -1531,7 +1531,7 @@
>     # end of $re_QID section
>
>     # see also ConnectionLost in $re_QID section
> -   elsif ( ($reason,$host,$hostip) = ($p1 =~ /lost connection (after [^ ]*) from ([^[]*)\[($re_IP|unknown)\]$/o )) {
> +   elsif ( ($reason,$host,$hostip) = ($p1 =~ /lost connection (after [^ ]*) (?:\(\d+ bytes\) )?from ([^[]*)\[($re_IP|unknown)\]$/o )) {
>        unless ($hostip =~ /unknown/) {
>           #TD lost connection after CONNECT from mail.example.com[192.168.0.1]
>           $Totals{'ConnectionLost'}++;
> @@ -1571,7 +1571,7 @@
>     }
>
>     # see also TimeoutInbound in $re_QID section
> -   elsif ( ($reason,$host,$hostip) = ($p1 =~ /^timeout (after [^ ]*) from ([^[]*)\[($re_IP)\]$/o)) {
> +   elsif ( ($reason,$host,$hostip) = ($p1 =~ /^timeout (after [^ ]*) (?:\(\d+ bytes\) )?from ([^[]*)\[($re_IP)\]$/o)) {
>        #TD timeout after RSET from example.com[192.168.0.1]
>        $Totals{'TimeoutInbound'}++;
>        $Counts{'TimeoutInbound'}{"\u$reason"}{formathost($hostip,$host)}++;




--
Alvaro Herrera       Valdivia, Chile   ICBM: S 39º 48' 55.3", W 73º 15' 24.7"
"The eagle never lost so much time, as
when he submitted to learn of the crow." (William Blake)



-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel

--- postfix.orig	2008-06-07 18:16:25.000000000 -0400
+++ postfix	2008-06-07 18:06:34.000000000 -0400
@@ -1531,7 +1531,7 @@
    # end of $re_QID section
 
    # see also ConnectionLost in $re_QID section
-   elsif ( ($reason,$host,$hostip) = ($p1 =~ /lost connection (after [^ ]*) from ([^[]*)\[($re_IP|unknown)\]$/o )) {
+   elsif ( ($reason,$host,$hostip) = ($p1 =~ /lost connection (after [^ ]*) (?:\(\d+ bytes\) )?from ([^[]*)\[($re_IP|unknown)\]$/o )) {
       unless ($hostip =~ /unknown/) {
          #TD lost connection after CONNECT from mail.example.com[192.168.0.1] 
          $Totals{'ConnectionLost'}++;
@@ -1571,7 +1571,7 @@
    }
 
    # see also TimeoutInbound in $re_QID section
-   elsif ( ($reason,$host,$hostip) = ($p1 =~ /^timeout (after [^ ]*) from ([^[]*)\[($re_IP)\]$/o)) {
+   elsif ( ($reason,$host,$hostip) = ($p1 =~ /^timeout (after [^ ]*) (?:\(\d+ bytes\) )?from ([^[]*)\[($re_IP)\]$/o)) {
       #TD timeout after RSET from example.com[192.168.0.1]
       $Totals{'TimeoutInbound'}++;
       $Counts{'TimeoutInbound'}{"\u$reason"}{formathost($hostip,$host)}++;