SF.net SVN: logwatch:[241] trunk
[email protected] Tue, 23 Sep 2014 11:50:13 +0000
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Revision: 241
http://sourceforge.net/p/logwatch/code/241
Author: stefjakobs
Date: 2014-09-23 11:50:13 +0000 (Tue, 23 Sep 2014)
Log Message:
-----------
update directory structure to support tags and branches
Added Paths:
-----------
braches/
tags/
trunk/
trunk/HOWTO-Customize-LogWatch
trunk/LICENSE
trunk/README
trunk/amavis-logwatch.1
trunk/conf/
trunk/ignore.conf.5
trunk/install_logwatch.sh
trunk/lib/
trunk/logwatch.8
trunk/logwatch.conf.5
trunk/logwatch.cron
trunk/override.conf.5
trunk/postfix-logwatch.1
trunk/scripts/
Removed Paths:
-------------
HOWTO-Customize-LogWatch
LICENSE
README
amavis-logwatch.1
conf/
ignore.conf.5
install_logwatch.sh
lib/
logwatch.8
logwatch.conf.5
logwatch.cron
override.conf.5
postfix-logwatch.1
scripts/
Deleted: HOWTO-Customize-LogWatch
===================================================================
--- HOWTO-Customize-LogWatch 2014-09-22 12:55:12 UTC (rev 240)
+++ HOWTO-Customize-LogWatch 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,569 +0,0 @@
-HOWTO-Customize-LogWatch
-================================================================================
-
-1. Table of Contents
-====================
-
- 1. Table of Contents
- 2. Introduction
- 3. Directory Structure
- A. Configuration Structure
- B. Executable Structure
- 4. Customizing the Configuration
- 5. Customizing the Scripts
- 6. Creating New Service Filters
- A. Logfile Groups
- B. Service Filter Configuration
- C. Service Filer Executable
- D. Shared Script Commands
- 7. For More Information
-
-
-
-
-This document describes the structure of the Logwatch files in the
-distribution, how to modify the configuration files for your
-system, and how to create new service filters.
-
-2. Introduction
-===============
-
-Logwatch is a system log analyzer and reporter. Usage information
-about Logwatch can be obtained through the man page:
- man logwatch
-
-The section titled "MORE INFORMATION" in the man page lists
-additional documentation files available with the distribution.
-
-A summary of the command-line switches described in the man page
-can be obtained with the '--help' option:
- logwatch --help
-
-The rest of this document is intended for those that wish to
-customize or enhance Logwatch beyond the capabilities provided
-with the command-line switches.
-
-
-3. Directory Structure
-======================
-
-This section describes the subdirectories and files shipped
-with the Logwatch distribution, using the names and locations
-used by default.
-
-The directory /usr/share/logwatch contains both the configuration
-and (perl) executable files. The contents of this directory are
-the following subdirectories:
-
- default.conf: Contains the default configuration files
- shipped with the Logwatch distribution
-
- dist.conf: Contains the configuration files shipped
- with your specific Operating Systems
- distribution.
-
- lib: Contains perl library files.
-
- scripts: Contains the perl executables.
-
-The /etc/logwatch directory contains the following subdirectories:
-
- conf: Contains the configuration files specific
- to the system.
-
- scripts: Contains the executable scripts specific
- to the system.
-
-A. Configuration Structure
---------------------------
-
-The contents of the three directories /usr/share/logwatch/default.conf,
-/usr/share/logwatch/dist.conf, and /etc/logwatch/conf, all have the
-same structure:
-
- services: This subdirectory contains the configuration
- files specific to each service. Logwatch
- determines which services are available by
- examining the contents of this directory.
- Each service configuration file is named by
- its service name with the ".conf" suffix.
-
- logfiles: This subdirectory contains the logfile group
- configuration files. Each logfile group
- configuration file contains information about
- one or more log files with the same format.
- Several services may use the same logfile
- group configuration file. Each of these
- configuration files are named by the group
- name with the ".conf" suffix. Many
- of the group names are taken from the name
- of a system log file (such as messages,
- maillog, secure, etc.), but not always.
-
- logwatch.conf: This file contains the defaults for the
- overall execution of Logwatch, and affect all
- of its services. Many of its parameters can
- be overridden by command-line switches when
- invoking the Logwatch executable, as described
- in the man page for Logwatch.
-
- ignore.conf: This file specifies regular expressions that,
- when matched by the output of logwatch, will
- suppress the matching line, regardless of which
- service is being executed.
-
-The /etc/logwatch/conf directory may also contain the file 'override.conf',
-which is described in section 4, "Customizing the Configuration."
-
-
-B. Executable Structure
------------------------
-
-The contents of the two directories /usr/share/logwatch/scripts
-and /etc/logwatch/scripts have the same structure:
-
- services: This subdirectory contains the executable
- for each service. Unless otherwise specified
- in the configuration service file (see above),
- the executables are written in the perl language.
-
- shared: This subdirectory contains executables that may
- be invoked by more than one configuration service
- file.
-
- logfiles: This subdirectory may contain subdirectories with
- logfile group names. The executables under each of
- these subdirectories are automatically invoked when
- running a service that uses the corresponding
- logfile group name.
-
-
-4. Customizing the Configuration
-================================
-
-Logwatch can be, and has been, used on many variants of the Linux and
-UNIX systems. Some distributions that include Logwatch modify the
-default configuration to comply with the settings of said
-distributions. Therefore, most people will not need to make any
-modifications to Logwatch.
-
-However, Logwatch, starting with version 7.0, implements a mechanism
-to allow modifying the local system easier. These modifications may
-be needed either because the configuration of the service that writes
-to the system log has been altered from its default, or because the
-Logwatch user prefers what is reported or how it is reported by
-Logwatch to be different.
-
-You can customize the output of logwatch by modifying variables in the
-/etc/logwatch/conf directory.
-
-Default values are specified in the /usr/share/logwatch/default.conf
-directory. Your distribution may have set additional defaults in the
-/usr/share/logwatch/dist.conf directory. All the variables available
-are declared in the files under these directories. You can change the
-default values to modify how or what is displayed with logwatch.
-
-One variable available to all services, and which by default is not
-specified, is the 'Detail' variable (note that it is not preceded by
-a '$' symbol). Specifying a Detail value will override the global
-Detail level, for that service only.
-
-There are two mechanisms for customizing the variables:
-
-1. The /etc/logwatch/conf directory is first searched for files with the
- same name and relative location as the
- /usr/share/logwatch/default.conf directory. Variables declared in
- these files override the defaults.
-
- For example, if file /etc/logwatch/conf/services/sendmail.conf has the
- single entry:
- $sendmail_unknownusersthreshold = 5
- then the threshold for unknown users is set to five instead of the
- default of one. All other parameters are not modified.
-
- The configuration files have four different types of declarations,
- determined by the first character in each line:
-
- '#': Rest of line is a comment, and is ignored.
- '$': Rest of first field is a variable
- '*': Denotes the name of an executable script
-
- Other than blank lines, the only other declarations are
- reserved variable names, such as LogFile, Archive, etc.
-
- In general, setting a variable overrides any value previously set.
- However, the following variables are cumulative:
- - In logwatch.conf: LogFile, Service
- - In services/service_name.conf: LogFile
- - In logfiles/service_name.conf: LogFile, Archive
-
- To remove all previous declarations of that variable, set the
- variable to the empty string. Duplicate values in the cumulative
- variables are deleted.
-
- If an executable script is declared in an /etc/logwatch/conf file,
- all of the executable script declarations in the corresponding file
- in /usr/share/logwatch/default.conf or /usr/share/logwatch/dist.conf
- are ignored.
-
- Because of the way variables and executable scripts are declared,
- the files in /etc/logwatch/conf/ can be created in one of two ways:
-
- - you can create a file with only the modified variables (and
- new executable script declarations, if needed), as described
- above, or
-
- - you can copy an entire configuration file from
- /usr/share/logwatch/default.conf to its corresponding location in
- /etc/logwatch/conf, and then modify those lines that require it.
- Because duplicates are removed from cumulative variables, and
- new executable script groups override the old ones, the output
- should be correct.
-
-2. The /etc/logwatch/conf/override.conf file is then searched. The first
- field in each line may be one of the following:
-
- #
- This character indicates that the rest of the line is a
- comment, and is ignored.
-
- logwatch:
- This string indicates that the rest of the line is a global
- configuration option, and uses the same syntax as the
- /usr/share/logwatch/default.conf/logwatch.conf file.
-
- services/service_name:
- (Where service_name is the name of a service.) This string
- indicates that the rest of the line is a configuration
- option for the specified service, and uses the same syntax
- as the /usr/share/logwatch/default.conf/services files.
-
- logfiles/service_name:
- (Where service_name is the name of a service.) This string
- indicates that the rest of the line is a configuration
- option for the specified service, and uses the same syntax
- as the /usr/share/logwatch/default.conf/logfiles files.
-
-
- For example, if the file /etc/logwatch/conf/override.conf has the single
- entry:
- logwatch: Detail = High
- then the default detail level for all services will be set to High.
-
-
- And, in file override.conf, the following declaration:
- logfiles/messages: LogFile = syslog
-
- will analyze the syslog file (in addition to the default messages file)
- for certain services. But the following two declarations combined:
-
- logfiles/messages: LogFile =
- logfiles/messages: LogFile = syslog
-
- will cause the messages file to be ignored for those same services,
- and only the syslog file will be used.
-
-
-5. Customizing the Scripts
-==========================
-
-Similarly to the way you can customize the configuration, as
-specified in section 4, you can override the default executable
-scripts.
-
-This is accomplished by placing an executable file with the same
-name and relative path (with respect to /usr/share/logwatch/scripts)
-under the /etc/logwatch/scripts directory. If such a file is
-found in the /etc/logwatch/scripts directory, the corresponding
-file under /usr/share/logwatch/scripts will be ignored.
-
-
-6. Creating New Service Filters
-===============================
-
-New services may be created by creating new configuration and
-executable files, described above, and placing them in the
-/etc/logwatch directory. This section provides additional
-details and examples for creating new service filters, but
-it might be easier to base the new files on the existing
-configuration and script files under the /usr/share/logwatch
-directory.
-
-
-
-A. Logfile Groups
------------------
-
-There is only one required line in the logfile group config file. This
-command is called 'LogFile'.
-
-# This will be the logfile named 'messages' in the default logfile
-# directory (probably /var/log).
-LogFile = messages
-
-# You can also give this command with an absolute path, like this:
-LogFile = /var/log/messages
-
-You can have as many LogFile entries as you wish. All the files specified
-will be merged into one input stream for any filters that use this logfile
-group. You can also use standard wildcards when you specify the filename.
-
-Another command that is optional is called 'Archive'. You can specify a
-file to also include in the data stream if the '--archives' option is used.
-If these files do not exist it is okay. For example:
-
-# These 2 'Archive' entries will allow users of most Red Hat Linux
-# systems to access their archives of the 'messages' logfile:
-Archive = messages.?
-# If they configure Compression to be on in /etc/logrotate.conf:
-Archive = messages.?.gz
-# It is best just to include both of these so that the logfile group
-# will work for most systems.
-
-Now, the general theory is that the LogFile Group should apply the date
-range requested. If the logfile is in the standard syslog format, you can
-use the shared script 'ApplyStdDate' to filter out only the appropriate log
-entries. The way to call shared scripts (located under
-/usr/share/logwatch/scripts/shared) is:
-
-*ApplyStdDate =
-
-Anything following the equal sign will be passed to the program as arguments
-(the equal sign can be eliminated if no arguments are needed). You should
-look at the current logfile group config files for examples.
-
-
-Finally, if the directory /usr/share/logwatch/scripts/logfiles/<logfile_group_name>/
-exists, any scripts in that directory will be executed. All of these
-scripts take the contents of all the specified logfiles in through STDIN and
-output the modified logfile trought STDOUT.
-
-
-B. Service Filter Configuration File
-------------------------------------
-
-Once you have defined one or more logfile groups (or decided on one or
-more existing logfile groups), you need to define your service filter.
-
-This file needs to be in /etc/logwatch/conf/services/ and it needs to be
-named service_name.conf, where service_name is the name of the service.
-You should probably copy an existing config for another service to create
-a new one.
-
-There is only one required line. This is the command 'LogFile'. The
-LogFile command allows you to specify one or more *LogFile Groups* (as
-described above) that this filter will process. Remember, any filter can
-process any number of LogFile Groups, and any LogFile Group may contain the
-data from any number of logfiles (and archives).
-
-For a service filter that needs messages from /var/log/messages you would
-add this line:
-
-LogFile = messages
-
-NOTE: This is *not* because the name of the logfile is 'messages', but it
-is because the name of the LogFile Group that has been defined is
-'messages'.
-
-You can have commands in the form of:
-
-*SharedScriptName = Arguments
-
-that will execute a script found in the /usr/share/logwatch/scripts/shared/
-directory named 'SharedScriptName' with arguments 'Arguments'.
-This filter will modify the input to the service's filter.
-
-You can also have commands in the form:
-
-$EnvironmentVariable = Value
-
-This command will set the 'EnvironmentVariable' environment variable to the
-value 'Value'. This environment variable will be accessable by your filter
-program.
-
-You will also usually want to specify a title for your script (new in
-Logwatch 4.0). If specified, then a start and stop delimiter will be added
-by Logwatch for your specific service (with your script's output between
-those delimiters). This will *only* happen if you produce output. If you
-produce no output, the headers will not be created. Here is how you define
-your title:
-
-Title = "My Service Title"
-
-
-C. Service Filter Executable
-----------------------------
-
-Once everything above has been done, you are ready to actually write
-your filter. This can be done in any language as all it does is:
-1) Read logfile entries from STDIN
-2) Access some environment variables
-3) Generate a report on STDOUT
-
-Before you try to write a filter, you should create the filter and make its
-contents the test script given below. The filter needs to be located in
-/etc/logwatch/scripts/services/ and named service_name (because you named the
-config file service_name.conf).
-
-###################### Cut Here #########################
-#!/bin/bash
-# This is as nice script that will show you the lines you will
-# be processing and reporting on. It will first display the
-# standard environment variables and then it takes STDIN and
-# dump it right back out to STDOUT.
-
-# These are the standard environment variables. You can define
-# more in your service config file (see above).
-echo "Date Range: $LOGWATCH_DATE_RANGE"
-echo "Detail Level: $LOGWATCH_DETAIL_LEVEL"
-echo "Temp Dir: $LOGWATCH_TEMP_DIR"
-echo "Debug Level: $LOGWATCH_DEBUG"
-
-# Now take STDIN and dump it to STDOUT
-cat
-###################### Cut Here #########################
-
-If you temporarily replace a script such as 'pam' with the above, you will
-notice that much has been cut out of /var/log/messages before it gets to
-this filter.
-
-The value of the environment variable LOGWATCH_DETAIL_LEVEL can be any
-integer. In reality, it is usually 0 (for low), 5 (for medium), and 10
-(for high).
-
-Your script should only produce output as appropriate. If there are no
-relevant log entries, no output should be produced. Likewise, if you are
-reporting two things, such as "Good Logins" and "Bad Logins", you should
-only produce even the headers when appropriate. For example:
-
-Bad Logins:
- amber (2 time(s))
- kirk (3 time(s))
-
-Good Logins:
- amber (5 time(s))
- kirk (10 time(s))
-
-But, if no failed logins occur, you should only output:
-
-Good Logins:
- amber (5 time(s))
- kirk (10 time(s))
-
-Note that there is no "Bad Logins:" header as there were no bad logins. You
-should also use the detail environment variable when deciding what to
-output. Bad logins might always be displayed, but good logins might only be
-displayed at higher detail levels. Here is a guide on how you should
-use the detail setting:
-
-0 (Low): Display only errors and security-related issues
-5 (Med): Display anything that a typical administator would be interested in
-10 (High): Display anything that a paranoid administrator would want to see
-
-In some cases, you can use a security setting higher than 10. This would be
-reserved for information so trivial that it would not even interest the US
-Government.
-
-D. Shared Script Commands
--------------------------
-
-The way to call commands is:
-
-*SharedScriptCommand [= Arguments]
-
-Logwatch will search for the command in /usr/share/logwatch/scripts/shared/ and
-/etc/logwatch/scripts/shared/. The command name is case insensitiv and can be
-used in logfile and service group configuratin files. Everything after the
-equal sign will be passed as arguments to the command.
-The following shared scripts are shipped with logwatch (they don't accept any
-arguments unless otherwise mentioned):
-
- - ApplyBindDate
- Filter messages with a time format of '%d-%b-%Y %H:%M:%S'
- - ApplyEuroDate
- Filter messages with a time format of '%Y-%m-%d %H:%M:%S'
- - ApplyHttpDate
- Filter messages with a time format of '%d/%b/%Y:%H:%M:%S'
- - ApplyStdDate
- Without argument filter messages with a time format of
- '%b %e %H:%M:%S' or '%Y-%m-%dT%H:%M:%S\.[0-9]+[+-][0-9]{2}:[0-9]{2}
- which is the ISO8601 logformat
- It accepts one argument which is the filter string, e.g.:
- *applystddate = "%m-%d-%Y %H:%M:%S"
- - ApplyTaiDate
- Filter messages which start with a hex string which represents
- the seconds since 01.01.1970.'
- - ApplyUSDate
- Filter messages with a time format of '%m/%d/%y:%H:%M:%S'
- - ApplyVsftpdDate
- Filter messages with a time format of '... %b %e %H:%M:%S 20%y'
- - EventLogOnlyService
- Filter messages which match: '... .. ..:..:.. .* MSWinEventLog\t\d+\t$ServiceName\t'
- It accepts one argument which is the $ServiceName
- - EventLogRemoveService
- Will remove the unwanted service from a logfile in a WinEventLog
- format. Drops messages which match the pattern in
- EventLogOnlyService. Accepts one argument which is $ServiceName
- - ExpandRepeats
- This used to expand "Last message repeated n Times" messages
- in standard sslog files. But it now ignores these lines, as
- otherwise the temporary logfiles will be too huge.
- - HostHash
- Print all hostnames which occured in a logfile. This matches only
- at default syslog format: '^... .. ..:..:.. ([\w\-\_]+)'
- - HostList
- Write a list of all hostnames which occured in a logfile to
- $LOGWATCH_TEMP_DIR/hostfile. This matches only at default
- syslog format: '^... .. ..:..:.. (\S*)'
- - MultiService
- This will pick out only the wanted service from a logfile in
- the standard syslog message format. Case insensitive.
- Accepts a comma separated list of service names as argument.
- - OnlyContains
- Just does a case insensitive egrep. Arguments are passed
- directly to egrep.
- - OnlyHost
- This will pick out only lines from $hostname from a logfile in the
- standard syslog format. Case insensitive.
- Set logwatch option LOGWATCH_ONLY_HOSTNAME or pass a comma
- separated list of hostnames as argument to make this work.
- - OnlyService
- This will pick out only the wanted service from a logfile in the
- standard syslog format. Case insensitive. First argument is the
- service name.
- - Remove
- Just a case insensitive, inverse egrep
- - RemoveHeaders
- Remove the beginning of each line of a standard syslog-style,
- Solaris ID tag style or date-prefix-style logfile.
- The pattern to remove is configurable and can be passed
- as the first argument, e.g.:
- * RemoveHeaders = "\d{4}-\d\d-\d\d \d\d:\d\:\d\d "
- - RemoveService
- Remove the unwanted service form a logfile in the standard
- syslog-style message format. Case insensitive.
- It accepts one argument which is a comma separated list of
- service names, e.g.:
- * RemoveService = "myservice,myotherservice"
-
-
-7. For More Information
-=======================
-
-The introduction of this document listed additional sources of information.
-In addition, the website http://www.logwatch.org contains:
- - the current (and some archived) distributions of Logwatch
- - access to mailing lists where comments, suggestions, bug reports,
- etc., are welcome.
- - access to the svn repository, for the very latest code.
-
-If you do create new services or enhancements that you feel would be useful
-to other people, please send them to the mailing list 'logwatch-devel at
-lists.sourceforge.net'.
-
-If you send patches, please make sure that you have the latest version
-of the file from svn, and send the patch file in unified format
-(using 'svn diff' or 'diff -u') as an attachment.
-
-Enhancement suggestions are more likely to be implemented if patch files
-implementing the change are sent.
Deleted: LICENSE
===================================================================
--- LICENSE 2014-09-22 12:55:12 UTC (rev 240)
+++ LICENSE 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,20 +0,0 @@
-Copyright (c) 2011 Kirk Bauer
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
Deleted: README
===================================================================
--- README 2014-09-22 12:55:12 UTC (rev 240)
+++ README 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,101 +0,0 @@
-What is Logwatch?
-
-Logwatch is a customizable, pluggable log-monitoring system. It will go
-through your logs for a given period of time and make a report in the areas
-that you wish with the detail that you wish.
-
-Perl 5.8 or newer is recommended to run Logwatch. [But it will work with 5.6.1+]
-
-------------------------------------------------------------------
-
-How do I install it?
-
-An rpm file is available. The following describes how to install if you
-prefer to install from the source tar file:
-
-The simplest setup is to follow the default configurations.
-Simply make a directory (/usr/share/logwatch) and copy the
-scripts, conf, and lib directories into that directory.
-You will also need to make the /etc/logwatch dir if you want to make
-configuration changes without having to modify the default config files.
-
-The steps to follow to get the default setup going are something like this.
-[However we recommend using the install_logwatch.sh script when possible.]
-
-Untar logwatch.
-cd logwatch-x.x
-mkdir /etc/logwatch
-mkdir /etc/logwatch/scripts
-mkdir /etc/logwatch/conf
-mkdir /etc/logwatch/conf/logfiles
-mkdir /etc/logwatch/conf/services
-touch /etc/logwatch/conf/logwatch.conf
-touch /etc/logwatch/conf/ignore.conf
-touch /etc/logwatch/conf/override.conf
-
-mkdir /usr/share/logwatch
-mkdir /usr/share/logwatch/dist.conf
-mkdir /usr/share/logwatch/dist.conf/logfiles
-mkdir /usr/share/logwatch/dist.conf/services
-
-mv conf/ /usr/share/logwatch/default.conf
-mv scripts/ /usr/share/logwatch/scripts
-mv lib /usr/share/logwatch/lib
-
-mkdir /var/cache/logwatch
-ln -s /usr/share/logwatch/scripts/logwatch.pl /etc/cron.daily/0logwatch
-ln -s /usr/share/logwatch/scripts/logwatch.pl /usr/sbin/logwatch
-
-This is only a suggestion and if you look at the logwatch.pl script and the
-logwatch.conf file you will see that you can configure the system layout in many
-different ways.
-
-See also the file HOWTO-Customize-LogWatch for more information.
-
-------------------------------------------------------------------
-
-How do I use it?
-
-Well, it should pretty much work on its own, sending you an
-email every night. For more configuration options, run
-'logwatch --help' or edit /usr/share/logwatch/default.conf/logwatch.conf
-or /etc/logwatch/logwatch.conf.
-
-See the file HOWTO-Customize-LogWatch for more information.
-
-You can also use it from the command line (as documented in the
-man page).
-
-------------------------------------------------------------------
-
-If you want me to add support for a new set of log entries, please
-email me all the log entries you can from that service from as many
-machines as possible! Or, better yet, read the HOWTO-Customize-LogWatch
-and write your own!
-
-------------------------------------------------------------------
-
-Mailing lists available!
-
-Logwatch Development List:
- For discussion about Logwatch development.
- To Subscribe: visit https://lists.sourceforge.net/lists/listinfo/logwatch-devel
- Send Mail To: [email protected]
-
-------------------------------------------------------------------
-
-Please send suggestions, bug reports, and patches to:
-logwatch-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
-
-Please ask questions at:
[email protected]
-
-------------------------------------------------------------------
-
-AUTHOR CONTACT INFORMATION:
- Kirk Bauer <[email protected]>
- http://www.kaybee.org/kirk/
-
-Newest releases can be found at:
- https://sourceforge.net/projects/logwatch/files/
-
Deleted: amavis-logwatch.1
===================================================================
--- amavis-logwatch.1 2014-09-22 12:55:12 UTC (rev 240)
+++ amavis-logwatch.1 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,923 +0,0 @@
-.TH AMAVIS-LOGWATCH 1
-.ad
-.fi
-.SH NAME
-amavis-logwatch
-\-
-An Amavisd-new log parser and analysis utility
-.SH "SYNOPSIS"
-.na
-.nf
-.fi
-\fBamavis-logwatch\fR [\fIoptions\fR] [\fIlogfile ...\fR]
-.SH DESCRIPTION
-.ad
-.fi
-The \fBamavis-logwatch\fR(1) utility is an Amavisd-new log parser
-that produces summaries, details, and statistics regarding
-the operation of Amavisd-new (henceforth, simply called Amavis).
-.PP
-This utility can be used as a
-standalone program, or as a Logwatch filter module to produce
-Amavisd-new summary and detailed reports from within Logwatch.
-.PP
-\fBAmavis-logwatch\fR is able to produce
-a wide range of reports with data grouped and sorted as much as possible
-to reduce noise and highlight patterns.
-Brief summary reports provide a
-quick overview of general Amavis operations and message
-delivery, calling out warnings that may require attention.
-Detailed reports provide easy to scan, hierarchically-arranged
-and organized information, with as much or little detail as
-desired.
-.PP
-Much of the interesting data is available when Amavis'
-$log_level is set to at least 2.
-See \fBAmavis Log Level\fR below.
-.PP
-\fBAmavis-logwatch\fR outputs two principal sections: a \fBSummary\fR section
-and a \fBDetailed\fR section.
-For readability and quick scanning, all event or hit counts appear in the left column,
-followed by brief description of the event type, and finally additional
-statistics or count representations may appear in the rightmost column.
-
-The following segment from a sample Summary report illustrates:
-.RS 4
-.nf
-
-****** Summary ********************************************
-
- 9 Miscellaneous warnings
-
- 20313 Total messages scanned ---------------- 100.00%
-1008.534M Total bytes scanned 1,057,524,252
-======== ================================================
-
- 1190 Blocked ------------------------------- 5.86%
- 18 Malware blocked 0.09%
- 4 Banned name blocked 0.02%
- 416 Spam blocked 2.05%
- 752 Spam discarded (no quarantine) 3.70%
-
- 19123 Passed -------------------------------- 94.14%
- 47 Bad header passed 0.23%
- 19076 Clean passed 93.91%
-======== ================================================
-
- 18 Malware ------------------------------- 0.09%
- 18 Malware blocked 0.09%
-
- 4 Banned -------------------------------- 0.02%
- 4 Banned file blocked 0.02%
-
- 1168 Spam ---------------------------------- 5.75%
- 416 Spam blocked 2.05%
- 752 Spam discarded (no quarantine) 3.70%
-
- 19123 Ham ----------------------------------- 94.14%
- 47 Bad header passed 0.23%
- 19076 Clean passed 93.91%
-======== ================================================
-
- 1982 SpamAssassin bypassed
- 32 Released from quarantine
- 2 DSN notification (debug supplemental)
- 2 Bounce unverifiable
- 2369 Whitelisted
- 2 Blacklisted
- 12 MIME error
- 58 Bad header (debug supplemental)
- 40 Extra code modules loaded at runtime
-
-.fi
-.RE 0
-The report indicates there were 9 general warnings, and
-\fBAmavis\fR scanned a total of 20313 messages
-for a total of 1008.53 megabytes or 1,057,524,252 bytes.
-The next summary groups shows the Blocked / Passed overview,
-with 1190 Blocked messages (broken down as 18 messages blocked as malware,
-4 messages with banned names, 416 spam messages, and 752 discarded
-messages), and 19123 Passed messages (47 messages with bad headers
-and 19076 clean messages).
-
-The next (optional) summary grouping shows message disposition by contents category.
-There were 18 malware messages and 4 banned file messages (all blocked),
-1168 Spam messages, of which 416 were blocked (quarantined) and 752 discarded.
-Finally, there were 19123 messages consdidered to be Ham (i.e. not spam), 47
-of which contained bad headers.
-
-Additional count summaries for a variety of events are also listed.
-.PP
-There are dozens of sub-sections available in the \fBDetailed\fR report, each of
-whose output can be controlled in various ways.
-Each sub-section attempts to group and present the most meaningful data at superior levels,
-while pushing less useful or \fInoisy\fR data towards inferior levels.
-The goal is to provide as much benefit as possible from smart grouping of
-data, to allow faster report scanning, pattern identification, and problem solving.
-Data is always sorted in descending order by count, and then numerically by IP address
-or alphabetically as appropriate.
-.PP
-The following Spam blocked segment from a sample \fBDetailed\fR report
-illustrates the basic hierarchical level structure of \fBamavis-logwatch\fR:
-.RS 4
-.nf
-
-****** Detailed *******************************************
-
- 19346 Spam blocked -----------------------------------
- 756 [email protected]
- 12 10.0.0.2
- 12 <>
- 12 192.168.2.2
- 12 <>
- 5 192.168.2.1
- ...
-
-.fi
-.RE 0
-.PP
-The \fBamavis-logwatch\fR utility reads from STDIN or from the named Amavis
-\fIlogfile\fR.
-Multiple \fIlogfile\fR arguments may be specified, each processed
-in order.
-The user running \fBamavis-logwatch\fR must have read permission on
-each named log file.
-.PP
-.SS Options
-The options listed below affect the operation of \fBamavis-logwatch\fR.
-Options specified later on the command line override earlier ones.
-Any option may be abbreviated to an unambiguous length.
-
-.IP "\fB--[no]autolearn\fR"
-.PD 0
-.IP "\fB--show_autolearn \fIboolean\fR"
-.PD
-Enables (disables) output of the autolearn report.
-This report is only available if the default Amavis \fB$log_templ\fR
-has been modified to provide autolearn results in log entries.
-This can be done by uncommenting two lines in the Amavis program itself (where the
-default log templates reside), or by correctly adding the \fB$log_templ\fR
-variable to the \fBamavisd.conf\fR file.
-See Amavis' \fBREADME.customize\fR and search near the end
-of the Amavisd program for "autolearn".
-.IP "\fB--[no]by_ccat_summary\fR"
-.PD 0
-.IP "\fB--show_by_ccat_summary \fIboolean\fR"
-.PD
-Enables (disables) the by contents category summary in the \fBSummary\fR section.
-Default: enabled.
-.IP "\fB-f \fIconfig_file\fR"
-.PD 0
-.IP "\fB--config_file \fIconfig_file\fR"
-.PD
-Use an alternate configuration file \fIconfig_file\fR instead of
-the default.
-This option may be used more than once.
-Multiple configuration files will be processed in the order presented on the command line.
-See \fBCONFIGURATION FILE\fR below.
-.IP "\fB--debug \fIkeywords\fR"
-Output debug information during the operation of \fBamavis-logwatch\fR.
-The parameter \fIkeywords\fR is one or more comma or space separated keywords.
-To obtain the list of valid keywords, use --debug xxx where xxx is any invalid keyword.
-.IP "\fB--detail \fIlevel\fR"
-Sets the maximum detail level for \fBamavis-logwatch\fR to \fIlevel\fR.
-This option is global, overriding any other output limiters described below.
-
-The \fBamavis-logwatch\fR utility
-produces a \fBSummary\fR section, a \fBDetailed\fR section, and
-additional report sections.
-With \fIlevel\fR less than 5, \fBamavis-logwatch\fR will produce
-only the \fBSummary\fR section.
-At \fIlevel\fR 5 and above, the \fBDetailed\fR section, and any
-additional report sections are candidates for output.
-Each incremental increase in \fIlevel\fR generates one additional
-hierarchical sub-level of output in the \fBDetailed\fR section of the report.
-At \fIlevel\fR 10, all levels are output.
-Lines that exceed the maximum report width (specified with
-\fBmax_report_width\fR) will be cut.
-Setting \fIlevel\fR to 11 will prevent lines in the report from being cut (see also \fB--line_style\fR).
-.IP "\fB--[no]first_recip_only\fR"
-.PD 0
-.IP "\fB--show_first_recip_only \fIboolean\fR"
-.PD
-Specifies whether or not to sort by, and show, only the first
-recipient when a scanned messages contains multiple recipients.
-.IP "\fB--help\fR"
-Print usage information and a brief description about command line options.
-.IP "\fB--ipaddr_width \fIwidth\fR"
-Specifies that IP addresses in address/hostname pairs should be printed
-with a field width of \fIwidth\fR characters.
-Increasing the default may be useful for systems using long IPv6 addresses.
-.IP "\fB-l limiter=levelspec\fR"
-.PD 0
-.IP "\fB--limit limiter=levelspec\fR"
-.PD
-Sets the level limiter \fIlimiter\fR with the specification \fIlevelspec\fR.
-.IP "\fB--line_style \fIstyle\fR"
-Specifies how to handle long report lines.
-Three styles are available: \fBfull\fR, \fBtruncate\fR, and \fBwrap\fR.
-Setting \fIstyle\fR to \fBfull\fR will prevent cutting lines to \fBmax_report_width\fR;
-this is what occurs when \fBdetail\fR is 11 or higher.
-When \fIstyle\fR is \fBtruncate\fR (the default),
-long lines will be truncated according to \fBmax_report_width\fR.
-Setting \fIstyle\fR to \fBwrap\fR will wrap lines longer than \fBmax_report_width\fR such that
-left column hit counts are not obscured.
-This option takes precedence over the line style implied by the \fBdetail\fR level.
-The options \fB--full\fR, \fB--truncate\fR, and \fB--wrap\fR are synonyms.
-
-.IP "\fB--nodetail\fR"
-Disables the \fBDetailed\fR section of the report, and all supplemental reports.
-This option provides a convenient mechanism to quickly disable all sections
-under the \fBDetailed\fR report, where subsequent command line
-options may re-enable one or more sections to create specific reports.
-
-.PD 0
-.IP "\fB--sarules \fR\`\fIS,H\fR\'"
-.IP "\fB--sarules default"
-.PD
-Enables the SpamAssassin Rules Hit report.
-The comma-separated \fIS\fR and \fIH\fR arguments are top N values for the Spam and Ham
-reports, respectively, and can be any integer greater than or equal to 0, or the keyword \fBall\fR.
-The keyword \fBdefault\fR uses the built-in default values.
-.IP "\fB--nosarules\fR"
-Disables the SpamAssassin Rules Hit report.
-
-.PD 0
-.IP "\fB--sa_timings \fR\fInrows\fR"
-Enables the SpamAssassin Timings percentiles report.
-The report can be limited to the top N rows with the \fInrows\fR argument.
-This report requires Amavis 2.6+ and SpamAssassin 3.3+.
-.PD
-.IP "\fB--sa_timings_percentiles \fR\`\fIP1 [P2 ...]\fR\'"
-Specifies the percentiles shown in the SpamAssassin Timings report.
-The arguments \fIP1 ...\fR are integers from 0 to 100 inclusive.
-Their order will be preserved in the report.
-.IP "\fB--nosa_timings\fR"
-Disables the SpamAssassin Timings report.
-.IP "\fB--version\fR"
-Print \fBamavis-logwatch\fR version information.
-
-.PD 0
-.IP "\fB--score_frequencies \fR\`\fIB1 [B2 ...]\fR\'"
-.IP "\fB--score_frequencies default"
-.PD
-Enables the Spam Score Frequency report.
-The arguments \fIB1 ...\fR are frequency distribution buckets, and can be any real numbers.
-Their order will be preserved in the report.
-The keyword \fBdefault\fR uses the built-in default values.
-.IP "\fB--noscore_frequencies\fR"
-Disables the Spam Score Frequency report.
-
-.PD 0
-.IP "\fB--score_percentiles \fR\`\fIP1 [P2 ...]\fR\'"
-.IP "\fB--score_percentiles default"
-.PD
-Enables the Spam Score Percentiles report.
-The arguments \fIP1 ...\fR specify the percentiles shown in the report,
-and are integers from 0 to 100 inclusive.
-The keyword \fBdefault\fR uses the built-in default values.
-.IP "\fB--noscore_percentiles\fR"
-Disables the Spam Score Percentiles report.
-
-.IP "\fB--[no]sect_vars\fR"
-.PD 0
-.IP "\fB--show_sect_vars \fIboolean\fR"
-.PD
-Enables (disables) supplementing each \fBDetailed\fR section title
-with the name of that section's level limiter.
-The name displayed is the command line option (or configuration
-file variable) used to limit that section's output.
-.
-With the large number of level limiters available in \fBamavis-logwatch\fR,
-this a convenient mechanism for determining exactly which level limiter
-affects a section.
-.IP "\fB--[no]startinfo\fR"
-.PD 0
-.IP "\fB--show_startinfo \fIboolean\fR"
-.PD
-Enables (disables) the Amavis startup report showing most recent Amavis startup details.
-.IP "\fB--[no]summary\fR"
-.IP "\fB--show_summary\fR"
-Enables (disables) displaying of the the \fBSummary\fR section of the report.
-The variable Amavis_Show_Summary in used in a configuration file.
-.IP "\fB--syslog_name \fInamepat\fR"
-Specifies the syslog service name that \fBamavis-logwatch\fR uses
-to match syslog lines.
-Only log lines whose service name matches
-the perl regular expression \fInamepat\fR will be used by
-\fBamavis-logwatch\fR; all non-matching lines are silently ignored.
-This is useful when a pre-installed Amavis package uses a name
-other than the default (\fBamavis\fR).
-
-\fBNote:\fR if you use parenthesis in your regular expression, be sure they are cloistering
-and not capturing: use \fB(?:\fIpattern\fB)\fR instead of \fB(\fIpattern\fB)\fR.
-
-.PD 0
-.IP "\fB--timings \fR\fIpercent\fR"
-Enables the Amavis Scan Timings percentiles report.
-The report can be top N-percent limited with the \fIpercent\fR argument.
-.PD
-.IP "\fB--timings_percentiles \fR\`\fIP1 [P2 ...]\fR\'"
-Specifies the percentiles shown in the Scan Timings report.
-The arguments \fIP1 ...\fR are integers from 0 to 100 inclusive.
-Their order will be preserved in the report.
-.IP "\fB--notimings\fR"
-Disables the Amavis Scan Timings report.
-.IP "\fB--version\fR"
-Print \fBamavis-logwatch\fR version information.
-
-.SS Level Limiters
-.PP
-The output of every section in the \fBDetailed\fR report is controlled by a level limiter.
-The name of the level limiter variable will be output when the \fBsect_vars\fR option is set.
-Level limiters are set either via command line in standalone mode with \fB--limit \fIlimiter\fB=\fIlevelspec\fR option,
-or via configuration file variable \fB$amavis_\fIlimiter\fB=\fIlevelspec\fR.
-Each limiter requires a \fIlevelspec\fR argument, which is described below in \fBLEVEL CONTROL\fR.
-
-The list of level limiters is shown below.
-
-.de TQ
-. br
-. ns
-. TP \\$1
-..
-
-.PD 0
-.PP
-Amavis major contents category (ccatmajor) sections, listed in order of priority:
-VIRUS, BANNED, UNCHECKED, SPAM, SPAMMY, BADH, OVERSIZED, MTA, CLEAN.
-
-.IP "\fBMalwareBlocked"
-.IP "\fBMalwarePassed"
-Blocked or passed messages that contain malware (ccatmajor: VIRUS).
-
-.IP "\fBBannedNameBlocked"
-.IP "\fBBannedNamePassed"
-Blocked or passed messages that contain banned names in MIME parts (ccatmajor: BANNED).
-
-.IP "\fBUncheckedBlocked"
-.IP "\fBUncheckedPassed"
-Blocked or passed messages that were not checked by a virus scanner or SpamAssassin (Amavis ccatmajor: UNCHECKED).
-
-.IP "\fBSpamBlocked"
-.IP "\fBSpamPassed"
-Blocked or passed messages that were considered spam that reached kill level (Amavis ccatmajor: SPAM)
-
-.IP "\fBSpammyBlocked"
-.IP "\fBSpammyPassed"
-Blocked or passed messages that were considered spam, but did not reach kill level (Amavis ccatmajor: SPAMMY)
-
-.IP "\fBBadHeaderBlocked"
-.IP "\fBBadHeaderPassed"
-Blocked or passed messages that contain bad mail headers (ccatmajor: BAD-HEADER).
-
-.IP "\fBOversizedBlocked"
-.IP "\fBOversizedPassed"
-Blocked or passed messages that were considered oversized (Amavis ccatmajor: OVERSIZED).
-
-.IP "\fBMtaBlocked"
-.IP "\fBMtaPassed"
-Blocked or passed messages due to failure to re-inject to MTA (Amavis ccatmajor: MTA-BLOCKED).
-Occurrences of this event indicates a configuration problem.
-[ note: I don't believe mtapassed occurs, but exists for completeness.]
-
-.IP "\fBOtherBlocked"
-.IP "\fBOtherPassed"
-Blocked or passed messages that are not any of other major contents categories (Amavis ccatmajor: OTHER).
-
-
-.IP "\fBTempFailBlocked"
-.IP "\fBTempfailPassed"
-Blocked or passed messages that had a temporary failure (Amavis ccatmajor: TEMPFAIL)
-
-.IP "\fBCleanBlocked"
-.IP "\fBCleanPassed "
-Messages blocked or passed which were considered clean (Amavis ccatmajor: CLEAN; i.e. non-spam, non-viral).
-
-.PP
-Other sections, arranged alphabetically:
-
-.IP "\fBAvConnectFailure"
-Problems connecting to Anti-Virus scanner(s).
-
-.IP "\fBAvTimeout"
-Timeouts awaiting responses from Anti-Virus scanner(s).
-
-.IP "\fBArchiveExtract"
-Archive extraction problems.
-
-.IP "\fBBadHeaderSupp"
-Supplemental debug information regarding messages containing bad mail headers.
-
-.IP "\fBBayes"
-Messages frequencies by Bayesian probability buckets.
-
-.IP "\fBBadAddress"
-Invalid mail address syntax.
-
-.IP "\fBBlacklisted"
-Messages that were (soft-)blacklisted. See also Whitelisted below.
-
-.IP "\fBBounceKilled"
-.IP "\fBBounceRescued"
-.IP "\fBBounceUnverifiable"
-Disposition of incoming bounce messages (DSNs).
-
-.IP "\fBContentType"
-MIME attachment breakdown by type/subtype.
-
-.IP "\fBDccError"
-Errors encountered with or returned by DCC.
-
-.IP "\fBDefangError"
-Errors encountered during defang process.
-
-.IP "\fBDefanged"
-Messages defanged (rendered harmless).
-
-.IP "\fBDsnNotification"
-Errors encountered during attempt to send delivery status notification.
-
-.IP "\fBDsnSuppressed"
-Delivery status notification (DSN) intentionally suppressed.
-
-.IP "\fBExtraModules"
-Additional code modules Amavis loaded during runtime.
-
-.IP "\fBFakeSender"
-Forged sender addresses, as determimed by Amavis.
-
-.IP "\fBFatal"
-Fatal events. These are presented at the top of the report, as they may require attention.
-
-.IP "\fBLocalDeliverySkipped"
-Failures delivering to a local address.
-
-.IP "\fBMalwareByScanner"
-Breakdown of malware by scanner(s) that detected the malware.
-
-.IP "\fBMimeError"
-Errors encountered during MIME extraction.
-
-.IP "\fBPanic"
-Panic events. These are presented at the top of the report, as they may require attention.
-
-.IP "\fBp0f"
-Passive fingerprint (p0f) hits, grouped by mail contents type (virus, unchecked, banned, spam, ham),
-next by operating system genre, and finally by IP address.
-Note: Windows systems are refined by Windows OS version, whereas versions of other operating systems
-are grouped generically.
-
-.IP "\fBReleased"
-Messages that were released from Amavis quarantine.
-
-.IP "\fBSADiags"
-Diagnostics as reported from SpamAssassin.
-
-.IP "\fBSmtpResponse"
-SMTP responses received during dialog with MTA. These log entries are primarly debug.
-
-.IP "\fBTmpPreserved"
-Temporary directories preserved by Amavis when some component encounters a problem or failure.
-Directories listed and their corresponding log entries should be evaluated for problems.
-
-.IP "\fBVirusScanSkipped"
-Messages that could not be scanned by a virus scanner.
-
-.IP "\fBWarning"
-Warning events not categorized in specific warnings below.
-These are presented at the top of the report, as they may require attention.
-
-.IP "\fBWarningAddressModified"
-Incomplete email addresses modified by Amavis for safety.
-
-.IP "\fBWarningNoQuarantineId"
-Attempts to release a quarantined message that did not contain an X-Quarantine-ID header.
-
-.IP "\fBWarningSecurity \fIlevelspec\fR"
-Insecure configuration or utility used by Amavis.
-
-.IP "\fBWarningSmtpShutdown"
-Failures during SMTP conversation with MTA.
-
-.IP "\fBWarningSql"
-Failures to communicate with, or error replies from, SQL service.
-
-.IP "\fBWhitelisted"
-Messages that were (soft-)whitelisted. See also Blacklisted above.
-
-.PD
-.SH LEVEL CONTROL
-.ad
-.fi
-The \fBDetailed\fR section of the report consists of a number of sub-sections,
-each of which is controlled both globally and independently.
-Two settings influence the output provided in the \fBDetailed\fR report:
-a global detail level (specified with \fB--detail\fR) which has final (big hammer)
-output-limiting control over the \fBDetailed\fR section,
-and sub-section specific detail settings (small hammer), which allow further limiting
-of the output for a sub-section.
-Each sub-section may be limited to a specific depth level, and each sub-level may be limited with top N or threshold limits.
-The \fIlevelspec\fR argument to each of the level limiters listed above is used to accomplish this.
-
-It is probably best to continue explanation of sub-level limiting with the following well-known outline-style hierarchy, and
-some basic examples:
-.nf
-
- level 0
- level 1
- level 2
- level 3
- level 4
- level 4
- level 2
- level 3
- level 4
- level 4
- level 4
- level 3
- level 4
- level 3
- level 1
- level 2
- level 3
- level 4
-.fi
-.PP
-The simplest form of output limiting suppresses all output below a specified level.
-For example, a \fIlevelspec\fR set to "2" shows only data in levels 0 through 2.
-Think of this as collapsing each sub-level 2 item, thus hiding all inferior levels (3, 4, ...),
-to yield:
-.nf
-
- level 0
- level 1
- level 2
- level 2
- level 1
- level 2
-.fi
-.PP
-Sometimes the volume of output in a section is too great, and it is useful to suppress any data that does not exceed a certain threshold value.
-Consider a dictionary spam attack, which produces very lengthy lists of hit-once recipient email or IP addresses.
-Each sub-level in the hierarchy can be threshold-limited by setting the \fIlevelspec\fR appropriately.
-Setting \fIlevelspec\fR to the value "2::5" will suppress any data at level 2 that does not exceed a hit count of 5.
-.PP
-Perhaps producing a top N list, such as top 10 senders, is desired.
-A \fIlevelspec\fR of "3:10:" limits level 3 data to only the top 10 hits.
-.PP
-With those simple examples out of the way, a \fIlevelspec\fR is defined as a whitespace- or comma-separated list of one or more of the following:
-.IP "\fIl\fR"
-Specifies the maximum level to be output for this sub-section, with a range from 0 to 10.
-if \fIl\fR is 0, no levels will be output, effectively disabling the sub-section
-(level 0 data is already provided in the Summary report, so level 1 is considered the first useful level in the \fBDetailed\fR report).
-Higher values will produce output up to and including the specified level.
-.IP "\fIl\fB.\fIn\fR"
-Same as above, with the addition that \fIn\fR limits this section's level 1 output to
-the top \fIn\fR items.
-The value for \fIn\fR can be any integer greater than 1.
-(This form of limiting has less utility than the syntax shown below. It is provided for
-backwards compatibility; users are encouraged to use the syntax below).
-.IP "\fIl\fB:\fIn\fB:\fIt\fR"
-This triplet specifies level \fIl\fR, top \fIn\fR, and minimum threshold \fIt\fR.
-Each of the values are integers, with \fIl\fR being the level limiter as described above, \fIn\fR being
-a top \fIn\fR limiter for the level \fIl\fR, and \fIt\fR being the threshold limiter for level \fIl\fR.
-When both \fIn\fR and \fIt\fR are specified, \fIn\fR has priority, allowing top \fIn\fR lists (regardless of
-threshold value).
-If the value of \fIl\fR is omitted, the specified values for \fIn\fR and/or \fIt\fR are used for
-all levels available in the sub-section.
-This permits a simple form of wildcarding (eg. place minimum threshold limits on all levels).
-However, specific limiters always override wildcard limiters.
-The first form of level limiter may be included in \fIlevelspec\fR to restrict output, regardless of how many triplets are present.
-.PP
-All three forms of limiters are effective only when \fBamavis-logwatch\fR's detail level is 5
-or greater (the \fBDetailed\fR section is not activated until detail is at least 5).
-.PP
-See the \fBEXAMPLES\fR section for usage scenarios.
-.SH CONFIGURATION FILE
-.ad
-\fBAmavis-logwatch\fR can read configuration settings from a configuration file.
-Essentially, any command line option can be placed into a configuration file, and
-these settings are read upon startup.
-
-Because \fBamavis-logwatch\fR can run either standalone or within Logwatch,
-to minimize confusion, \fBamavis-logwatch\fR inherits Logwatch's configuration
-file syntax requirements and conventions.
-These are:
-.IP \(bu 4'.
-White space lines are ignored.
-.IP \(bu 4'.
-Lines beginning with \fB#\fR are ignored
-.IP \(bu 4'.
-Settings are of the form:
-.nf
-
- \fIoption\fB = \fIvalue\fR
-
-.fi
-.IP \(bu 4'.
-Spaces or tabs on either side of the \fB=\fR character are ignored.
-.IP \(bu 4'.
-Any \fIvalue\fR protected in double quotes will be case-preserved.
-.IP \(bu 4'.
-All other content is reduced to lowercase (non-preserving, case insensitive).
-.IP \(bu 4'.
-All \fBamavis-logwatch\fR configuration settings must be prefixed with "\fB$amavis_\fR" or
-\fBamavis-logwatch\fR will ignore them.
-.IP \(bu 4'.
-When running under Logwatch, any values not prefixed with "\fB$amavis_\fR" are
-consumed by Logwatch; it only passes to \fBamavis-logwatch\fR (via environment variable)
-settings it considers valid.
-.IP \(bu 4'.
-The values \fBTrue\fR and \fBYes\fR are converted to 1, and \fBFalse\fR and \fBNo\fR are converted to 0.
-.IP \(bu 4'.
-Order of settings is not preserved within a configuration file (since settings are passed
-by Logwatch via environment variables, which have no defined order).
-.PP
-To include a command line option in a configuration file,
-prefix the command line option name with the word "\fB$amavis_\fR".
-The following configuration file setting and command line option are equivalent:
-.nf
-
- \fB$amavis_Line_Style = Truncate\fR
-
- \fB--line_style Truncate\fR
-
-.fi
-Level limiters are also prefixed with \fB$amavis_\fR, but on the command line are specified with the \fB--limit\fR option:
-.nf
-
- \fB$amavis_SpamBlocked = 2\fR
-
- \fB--limit SpamBlocked=2\fR
-
-.fi
-
-
-The order of command line options and configuration file processing occurs as follows:
-1) The default configuration file is read if it exists and no \fB--config_file\fR was specified on a command line.
-2) Configuration files are read and processed in the order found on the command line.
-3) Command line options override any options already set either via command line or from any configuration file.
-
-Command line options are interpreted when they are seen on the command line, and later options will override previously set options.
-
-
-.SH "EXIT STATUS"
-.na
-.nf
-.ad
-.fi
-The \fBamavis-logwatch\fR utility exits with a status code of 0, unless an error
-occurred, in which case a non-zero exit status is returned.
-.SH "EXAMPLES"
-.na
-.nf
-.ad
-.fi
-.SS Running Standalone
-\fBNote:\fR \fBamavis-logwatch\fR reads its log data from one or more named Amavis log files, or from STDIN.
-For brevity, where required, the examples below use the word \fIfile\fR as the command line
-argument meaning \fI/path/to/amavis.log\fR.
-Obviously you will need to substitute \fIfile\fR with the appropriate path.
-.nf
-.PP
-To run \fBamavis-logwatch\fR in standalone mode, simply run:
-.nf
-.RS 4
-.PP
-\fBamavis-logwatch \fIfile\fR
-.RE 0
-.nf
-.PP
-A complete list of options and basic usage is available via:
-.nf
-.RS 4
-.PP
-\fBamavis-logwatch --help\fR
-.RE 0
-.nf
-.PP
-To print a summary only report of Amavis log data:
-.nf
-.RS 4
-.PP
-\fBamavis-logwatch --detail 1 \fIfile\fR
-.RE 0
-.fi
-.PP
-To produce a summary report and a one-level detail report for May 25th:
-.nf
-.RS 4
-.PP
-\fBgrep 'May 25' \fIfile\fB | amavis-logwatch --detail 5\fR
-.RE 0
-.fi
-.PP
-To produce only a top 10 list of Sent email domains, the summary report and detailed reports
-are first disabled. Since commands line options are read and enabled left-to-right,
-the Sent section is re-enabled to level 1 with a level 1 top 10 limiter:
-.nf
-.RS 4
-.PP
-\fBamavis-logwatch --nosummary --nodetail \\
- --limit spamblocked '1 1:10:' \fIfile\fR
-.RE 0
-.fi
-.PP
-The following command and its sample output shows a more complex level limiter example.
-The command gives the top 4 spam blocked recipients (level 1), and under with each recipient
-the top 2 sending IPs (level 2) and finally below that, only envelope from addresses (level 3) with hit counts
-greater than 6.
-Ellipses indicate top N or threshold-limited data:
-.nf
-.RS 4
-.PP
-\fBamavis-logwatch --nosummary --nodetail \\
- --limit spamblocked '1:4: 2:2: 3::6' \fIfile\fR
-.nf
-
-19346 Spam blocked -----------------------------------
- 756 [email protected]
- 12 10.0.0.1
- 12 <>
- 12 10.99.99.99
- 12 <>
- ...
- 640 [email protected]
- 8 10.0.0.1
- 8 <>
- 8 192.168.3.19
- 8 <>
- ...
- 595 [email protected]
- 8 10.0.0.1
- 8 <>
- 7 192.168.3.3
- 7 <>
- ...
- 547 [email protected]
- 8 192.168.3.19
- 8 <>
- 7 10.0.0.1
- 7 <>
- ...
- ...
-.fi
-.RE 0
-.fi
-.SS Running within Logwatch
-\fBNote:\fR Logwatch versions prior to 7.3.6, unless configured otherwise, required the \fB--print\fR option to print to STDOUT instead of sending reports via email.
-Since version 7.3.6, STDOUT is the default output destination, and the \fB--print\fR option has been replaced
-by \fB--output stdout\fR. Check your configuration to determine where report output will be directed, and add the appropriate option to the commands below.
-.PP
-To print a summary report for today's Amavis log data:
-.nf
-.RS 4
-.PP
-\fBlogwatch --service amavis --range today --detail 1\fR
-.RE 0
-.nf
-.PP
-To print a report for today's Amavis log data, with one level
-of detail in the \fBDetailed\fR section:
-.nf
-.RS 4
-.PP
-\fBlogwatch --service amavis --range today --detail 5\fR
-.RE 0
-.fi
-.PP
-To print a report for yesterday, with two levels of detail in the \fBDetailed\fR section:
-.nf
-.RS 4
-.PP
-\fBlogwatch --service amavis --range yesterday --detail 6\fR
-.RE 0
-.fi
-.PP
-To print a report from Dec 12th through Dec 14th, with four levels of detail in the \fBDetailed\fR section:
-.nf
-.RS 4
-.PP
-\fBlogwatch --service amavis --range \\
- 'between 12/12 and 12/14' --detail 8\fR
-.RE 0
-.PP
-To print a report for today, with all levels of detail:
-.nf
-.RS 4
-.PP
-\fBlogwatch --service amavis --range today --detail 10\fR
-.RE 0
-.PP
-Same as above, but leaves long lines uncropped:
-.nf
-.RS 4
-.PP
-\fBlogwatch --service amavis --range today --detail 11\fR
-.RE 0
-.SS "Amavis Log Level"
-.PP
-Amavis provides additional log information when the variable
-\fB$log_level\fR is increased above the default 0 value.
-This information is used by the \fBamavis-logwatch\fR utility to provide additional reports,
-not available with the default \fB$log_level\fR=0 value.
-A \fB$log_level\fR of 2 is suggested.
-.PP
-If you prefer not to increase the noise level in your main mail or Amavis logs,
-you can configure syslog to log Amavis' output to multiple log files,
-where basic log entries are routed to your main mail log(s) and more detailed
-entries routed to an Amavis-specific log file used to feed the \fBamavis-logwatch\fR utility.
-.PP
-A convenient way to accomplish this is to change the Amavis
-configuration variables in \fBamavisd.conf\fR as shown below:
-.nf
-
- amavisd.conf:
- $log_level = 2;
- $syslog_facility = 'local5';
- $syslog_priority = 'debug';
-
-.fi
-.PP
-This increases \fB$log_level\fR to 2, and sends Amavis' log entries to
-an alternate syslog facility (eg. \fBlocal5\fR, user), which can then be
-routed to one or more log files, including your main mail log file:
-.nf
-
- syslog.conf:
- #mail.info -/var/log/maillog
- mail.info;local5.notice -/var/log/maillog
-
- local5.info -/var/log/amavisd-info.log
-
-.fi
-.PP
-\fBAmavis\fR' typical \fB$log_level\fR 0 messages will be directed to both your maillog
-and to the \fBamavisd-info.log\fR file, but higher \fB$log_level\fR messages
-will only be routed to the \fBamavisd-info.log\fR file.
-For additional information on Amavis' logging, search the
-file \fBRELEASE_NOTES\fR in the Amavis distribution for:
-.nf
-
- "syslog priorities are now dynamically derived"
-
-.fi
-.SH "ENVIRONMENT"
-.na
-.nf
-.ad
-.fi
-The \fBamavis-logwatch\fR program uses the following (automatically set) environment
-variables when running under Logwatch:
-.IP \fBLOGWATCH_DETAIL_LEVEL\fR
-This is the detail level specified with the Logwatch command line argument \fB--detail\fR
-or the \fBDetail\fR setting in the ...conf/services/amavis.conf configuration file.
-.IP \fBLOGWATCH_DEBUG\fR
-This is the debug level specified with the Logwatch command line argument \fB--debug\fR.
-.IP \fBamavis_\fIxxx\fR
-The Logwatch program passes all settings \fBamavis_\fIxxx\fR in the configuration file ...conf/services/amavis.conf
-to the \fBamavis\fR filter (which is actually named .../scripts/services/amavis) via environment variable.
-.SH "FILES"
-.na
-.nf
-.SS Standalone mode
-.IP "/usr/local/bin/amavis-logwatch"
-The \fBamavis-logwatch\fR program
-.IP "/usr/local/etc/amavis-logwatch.conf"
-The \fBamavis-logwatch\fR configuration file in standalone mode
-.SS Logwatch mode
-.IP "/etc/logwatch/scripts/services/amavis"
-The Logwatch \fBamavis\fR filter
-.IP "/etc/logwatch/conf/services/amavis.conf"
-The Logwatch \fBamavis\fR filter configuration file
-.SH "SEE ALSO"
-.na
-.nf
-logwatch(8), system log analyzer and reporter
-.SH "README FILES"
-.na
-.ad
-.nf
-README, an overview of \fBamavis-logwatch\fR
-Changes, the version change list history
-Bugs, a list of the current bugs or other inadequacies
-Makefile, the rudimentary installer
-LICENSE, the usage and redistribution licensing terms
-.SH "LICENSE"
-.na
-.nf
-.ad
-Covered under the included MIT/X-Consortium License:
-http://www.opensource.org/licenses/mit-license.php
-
-.SH "AUTHOR(S)"
-.na
-.nf
-Mike Cappella
-
-.fi
-The original \fBamavis\fR Logwatch filter was written by
-Jim O'Halloran, and has had many contributors over the years.
-They are entirely not responsible for any errors, problems or failures since the current author's
-hands have touched the source code.
Deleted: ignore.conf.5
===================================================================
--- ignore.conf.5 2014-09-22 12:55:12 UTC (rev 240)
+++ ignore.conf.5 2014-09-23 11:50:13 UTC (rev 241)
@@ -1 +0,0 @@
-.so man5/logwatch.conf.5
\ No newline at end of file
Deleted: install_logwatch.sh
===================================================================
--- install_logwatch.sh 2014-09-22 12:55:12 UTC (rev 240)
+++ install_logwatch.sh 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,337 +0,0 @@
-#!/bin/sh
-#
-#The MIT License
-#
-#Copyright (c) 2005-2006 Mike Tremaine <mgt /at/ stellarcore.net>
-#
-#Permission is hereby granted, free of charge, to any person obtaining
-#a copy of this software and associated documentation files (the "Software"),
-#to deal in the Software without restriction, including without limitation
-#the rights to use, copy, modify, merge, publish, distribute, sublicense,
-#and/or sell copies of the Software, and to permit persons to whom the
-#Software is furnished to do so, subject to the following conditions:
-#
-#The above copyright notice and this permission notice shall be included
-#in all copies or substantial portions of the Software.
-#
-#THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-#EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-#MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-#IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-#DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-#OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
-#THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-# __________________________________________________________________
-#
-# File: install_logwatch.sh
-# Author: Mike Tremaine [mgt /at/ stellarcore.net]
-# Maintainer: Mike Tremaine [mgt /at/ stellarcore.net]
-# $Id$
-#
-# $Log: install_logwatch.sh,v $
-# Revision 1.20 2008/05/12 22:53:28 mike
-# removed -T flag no sure why it was there -mgt
-#
-# Revision 1.19 2008/05/08 23:15:55 mike
-# Added install to logwatch.cron if no cron.daily dir. -mgt
-#
-# Revision 1.18 2008/05/08 22:47:41 mike
-# Added BIGGER note for the new cron requirement -mgt
-#
-# Revision 1.17 2007/11/28 16:06:56 mike
-# Prefix option code from Craig Ruff -mgt
-#
-# Revision 1.16 2007/11/28 15:50:43 mike
-# Typod Craig Ruff sorry -mgt
-#
-# Revision 1.15 2007/11/28 15:49:47 mike
-# Patch from Craig Ruff for MANDIR under Solaris -mgt
-#
-# Revision 1.14 2007/11/28 15:43:14 mike
-# Patch from Craig Ruff for CONFIGDIR munge -mgt
-#
-# __________________________________________________________________
-#
-#Note: This script is provided for the non-RPM installs.
-#It is preferred that logwatch be packaged by a distribution
-#specifically for your installation. But since that is not always
-#possible we have included this script.
-
-#Add PATHS for various OS options
-#Set PATH for solaris /usr/ucb/install
-PATH=/usr/ucb:$PATH
-#Set PATH for OpenBSD makewhatis /usr/libexec/makewhatis
-PATH=$PATH:/usr/libexec
-#Set PATH for IRIX makewhatis /usr/lib/makewhatis
-PATH=$PATH:/usr/lib
-export PATH
-
-#Set OS and GLOBIGNORE
-OS=`uname -s`
-GLOBIGNORE=*CVS
-
-#All these can be set via user input
-#Defaults
-BASEDIR="/usr/share/logwatch"
-CONFIGDIR="/etc/logwatch"
-TEMPDIR="/var/cache/logwatch"
-PERLEXE="/usr/bin/perl"
-MANDIR="/usr/share/man"
-
-#Command line options section
-#Currently only prefix is supported but now that the door is open other options should follow. -mgt
-ac_prev=
-for ac_option
-do
- # If the previous option needs an argument, assign it.
- if test -n "$ac_prev"; then
- eval "$ac_prev=\$ac_option"
- ac_prev=
- continue
- fi
-
- ac_optarg=`expr "x$ac_option" : 'x[^=]*=\(.*\)'`
-
- case $ac_option in
- -prefix | --prefix | --prefi | --pref | --pre | --pr | --p)
- ac_prev=prefix ;;
- -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*)
- prefix=$ac_optarg ;;
- *)
- echo "Unknown option '$ac_option'"
- ;;
- esac
-done
-
-if [ "x$prefix" != "x" ]; then
- BASEDIR=$prefix
- munge_base=1
- CONFIGDIR=$BASEDIR/etc
- munge_conf=1
- TEMPDIR=$BASEDIR/tmp
- munge_temp=1
- MANDIR=$BASEDIR/man
-fi
-
-
-#Talk to user
-printf "#################################\n"
-printf "Preparing to install Logwatch\n"
-printf "Enter the path to the Logwatch BaseDir [$BASEDIR] : "
-read base
-
-if [ "$base" = "" ]; then
- printf "### Using $BASEDIR\n"
-else
- BASEDIR="$base"
- #Set munge flag
- munge_base=1
- printf "### Using $BASEDIR [will modify logwatch.pl]\n"
-fi
-
-printf "Enter the path for the Logwatch ConfigDir [$CONFIGDIR] : "
-read config
-
-if [ "$config" = "" ]; then
- printf "### Using $CONFIGDIR\n"
-else
- CONFIGDIR="$config"
- munge_conf=1
- printf "### Using $CONFIGDIR [will modify logwatch.pl]\n"
-fi
-
-printf "Enter the dir name to be used for temp files [$TEMPDIR] : "
-read temp
-
-if [ "$temp" = "" ]; then
- printf "### Using $TEMPDIR\n"
-else
- TEMPDIR="$temp"
- munge_temp=1
- printf "### Using $TEMPDIR [will write to $CONFIGDIR/conf/logwatch.conf]\n"
-fi
-
-printf "Enter the location of perl [$PERLEXE] : "
-read perlexe
-
-if [ "$perlexe" = "" ]; then
- printf "### Using $PERLEXE\n"
-else
- PERLEXE="$perlexe"
- munge_perl=1
- printf "### Using $PERLEXE [will modify logwatch.pl]\n"
-fi
-
-printf "Enter the dir name to used for the manpage [$MANDIR] : "
-read mandir
-
-if [ "$mandir" = "" ]; then
- printf "### Using $MANDIR\n"
-else
- MANDIR="$mandir"
- printf "### Using $MANDIR [Will try to run makewhatis]\n"
-fi
-
-echo "### Installing"
-
-#OS Tests for known issues
-if [ $OS = "Darwin" ]; then
- munge_gzcat=1
-fi
-
-#Install is borked under IRIX
-#BASE
-install -m 0755 -d $BASEDIR
-install -m 0755 -d $BASEDIR/dist.conf
-install -m 0755 -d $BASEDIR/dist.conf/logfiles
-install -m 0755 -d $BASEDIR/dist.conf/services
-install -m 0755 -d $BASEDIR/default.conf
-install -m 0755 -d $BASEDIR/default.conf/logfiles
-install -m 0755 -d $BASEDIR/default.conf/services
-install -m 0755 -d $BASEDIR/default.conf/html
-install -m 0755 -d $BASEDIR/scripts
-install -m 0755 -d $BASEDIR/scripts/logfiles
-install -m 0755 -d $BASEDIR/scripts/services
-install -m 0755 -d $BASEDIR/scripts/shared
-install -m 0755 -d $BASEDIR/lib
-install -m 0644 README $BASEDIR/README
-install -m 0644 HOWTO-Customize-LogWatch $BASEDIR/HOWTO-Customize-LogWatch
-install -m 0644 conf/*.conf $BASEDIR/default.conf
-install -m 0644 conf/logfiles/* $BASEDIR/default.conf/logfiles
-install -m 0644 conf/services/* $BASEDIR/default.conf/services
-install -m 0644 conf/html/* $BASEDIR/default.conf/html
-install -m 0755 scripts/logwatch.pl $BASEDIR/scripts/logwatch.pl
-for i in scripts/logfiles/* ; do
- if [ `ls $i | grep -v CVS | wc -l` -ne 0 ] ; then
- install -m 0755 -d $BASEDIR/$i
- install -m 0644 $i/* $BASEDIR/$i
- fi
-done
-install -m 0644 scripts/shared/* $BASEDIR/scripts/shared
-install -m 0644 scripts/services/* $BASEDIR/scripts/services
-install -m 0644 lib/* $BASEDIR/lib
-
-if [ $munge_base ]; then
- perl -pi -e "s%/usr/share/logwatch%$BASEDIR%" $BASEDIR/scripts/logwatch.pl
-fi
-
-#CONFIG
-install -m 0755 -d $CONFIGDIR
-install -m 0755 -d $CONFIGDIR/scripts
-install -m 0755 -d $CONFIGDIR/scripts/services
-install -m 0755 -d $CONFIGDIR/conf
-install -m 0755 -d $CONFIGDIR/conf/logfiles
-install -m 0755 -d $CONFIGDIR/conf/services
-install -m 0755 -d $CONFIGDIR/conf/html
-
-if [ $munge_conf ]; then
- perl -pi -e "s%/etc/logwatch%$CONFIGDIR%" $BASEDIR/scripts/logwatch.pl
-fi
-
-touch $CONFIGDIR/conf/logwatch.conf
-touch $CONFIGDIR/conf/ignore.conf
-touch $CONFIGDIR/conf/override.conf
-
-#TEMP
-#Using sanity check incase someone uses /tmp.
-#The install would destory the perms on /tmp
-if [ ! -d $TEMPDIR ]; then
- #Should this be 0700 -d $TEMPDIR ??
- install -m 0755 -d $TEMPDIR
-fi
-
-#This can create duplicates need to grep first -mgt
-if [ $munge_temp ]; then
- echo "TmpDir = $TEMPDIR" >> $CONFIGDIR/conf/logwatch.conf
-fi
-
-#PERL
-if [ $munge_perl ]; then
- perl -pi -e "s%/usr/bin/perl%$PERLEXE%" $BASEDIR/scripts/logwatch.pl
-fi
-
-#Gzcat
-if [ $munge_gzcat ]; then
- echo "Pathtozcat = gzcat" >> $CONFIGDIR/conf/logwatch.conf
-fi
-
-#Search for makewhatis
-for f in `echo $PATH | tr : ' '`; do
- if [ -x "$f/makewhatis" ]; then
- HAVE_MAKEWHATIS=1;
- fi;
-done
-
-#Man page
-if [ -d $MANDIR/man5 ] && [ -d $MANDIR/man8 ] && [ -d $MANDIR/man1 ] && [ $HAVE_MAKEWHATIS ]; then
- install -m 0644 logwatch.8 $MANDIR/man8
- install -m 0644 logwatch.conf.5 $MANDIR/man5
- install -m 0644 override.conf.5 $MANDIR/man5
- install -m 0644 ignore.conf.5 $MANDIR/man5
- install -m 0644 postfix-logwatch.1 $MANDIR/man1
- install -m 0644 amavis-logwatch.1 $MANDIR/man1
- #OpenBSD no -s
- if [ $OS = "OpenBSD" ]; then
- makewhatis -u $MANDIR/man5 $MANDIR/man8 $MANDIR/man1
- else
- #FreeBSD and NetBSD no -s no -u
- if [ $OS = "FreeBSD" ] || [ $OS = "NetBSD" ]; then
- makewhatis $MANDIR/man5 $MANDIR/man8 $MANDIR/man1
- else
- #MacOS X aka Darwin no -u [even thought the manpage says]
- if [ $OS = "Darwin" ]; then
- makewhatis -o "1 5 8" $MANDIR
- else
- #Linux
- makewhatis -u -s "1 5 8" $MANDIR
- fi
- fi
- fi
-else
- if [ $OS = "SunOS" ]; then
- #Go for the safe install rather then editing man.cf
- mkdir -p $MANDIR/man1m > /dev/null 2>&1
- install -m 0644 logwatch.8 $MANDIR/man1m
- install -m 0644 logwatch.conf.5 $MANDIR/man1m
- install -m 0644 override.conf.5 $MANDIR/man1m
- install -m 0644 ignore.conf.5 $MANDIR/man1m
- install -m 0644 postfix-logwatch.1 $MANDIR/man1
- install -m 0644 amavis-logwatch.1 $MANDIR/man1
- catman -w -M $MANDIR/man1m
- else
- install -m 0755 -d $MANDIR/man1
- install -m 0644 postfix-logwatch.1 $MANDIR/man1
- install -m 0644 amavis-logwatch.1 $MANDIR/man1
-
- install -m 0755 -d $MANDIR/man5
- install -m 0644 logwatch.conf.5 $MANDIR/man5
- install -m 0644 override.conf.5 $MANDIR/man5
- install -m 0644 ignore.conf.5 $MANDIR/man5
-
- install -m 0755 -d $MANDIR/man8
- install -m 0644 logwatch.8 $MANDIR/man8
-
- printf "Installed manpages in $MANDIR/man1, $MANDIR/man5 and $MANDIR/man8.\n"
- printf "Check your man.cf or man.conf to enable MANSECTS 1, 5 and 8\n"
- fi
-fi
-
-#Symlink
-ln -f -s $BASEDIR/scripts/logwatch.pl /usr/sbin/logwatch
-printf "Created symlink for /usr/sbin/logwatch \n"
-
-#Cron
-if [ -d /etc/cron.daily ]; then
- rm -f /etc/cron.daily/0logwatch
- install -m 0755 logwatch.cron /etc/cron.daily/0logwatch
- printf "Created /etc/cron.daily/0logwatch \n"
-else
- install -m 0744 logwatch.cron $CONFIGDIR/logwatch.cron
- printf "################ README ####################.\n"
- printf "You need to setup your cron job for logwatch.\n"
- printf "A sample script is included see $CONFIGDIR/logwatch.cron. \n"
- printf "2 0 * * * $CONFIGDIR/logwatch.cron >/dev/null 2>&1 \n"
-fi
-
-exit
-# vi: shiftwidth=3 tabstop=3 et
Deleted: logwatch.8
===================================================================
--- logwatch.8 2014-09-22 12:55:12 UTC (rev 240)
+++ logwatch.8 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,165 +0,0 @@
-.\" Process this file with
-.\" groff -man -Tascii foo.1
-.\"
-.TH LOGWATCH 8 "May 2012" Linux "User Manuals"
-.SH NAME
-logwatch \- system log analyzer and reporter
-.SH SYNOPSIS
-.B logwatch [--detail
-.I level
-.B ] [--logfile
-.I log-file-group
-.B ] [--service
-.I service-name
-.B ] [--mailto
-.I address
-.B ] [--archives] [--range
-.I range
-.B ] [--debug
-.I level
-.B ] [--filename
-.I file-name
-.B ] [--logdir
-.I directory
-.B ] [--hostlimit
-.I hosts
-.B ] [--hostname
-.I hostname
-.B ] [--html_wrap
-.I number of characters
-.B ] [--hostformat
-.I host based options
-.B ] [--output
-.I output-type
-.B ] [--format
-.I report format
-.B ] [--encode
-.I encoding to use
-.B ] [--numeric] [--version] [--help|--usage]
-.SH DESCRIPTION
-.B Logwatch
-is a customizable, pluggable log-monitoring system. It will go
-through your logs for a given period of time and make a report in the areas
-that you wish with the detail that you wish. Logwatch is being used for
-Linux and many types of UNIX.
-.SH OPTIONS
-.IP "\fB--detail\fR level"
-This is the detail level of the report.
-.I level
-can be a positive integer, or high, med, low, which correspond to the
-integers 10, 5, and 0, respectively.
-.IP "\fB--logfile\fR log-file-group"
-This will force Logwatch to process only the set of logfiles
-defined by
-.I log-file-group
-(i.e. messages, xferlog, ...). Logwatch will therefore process
-all services that use those logfiles. This option can be specified
-more than once to specify multiple logfile-groups.
-.IP "\fB--service\fR service-name"
-This will force Logwatch to process only the service specified in
-.I service-name
-(i.e. login, pam, identd, ...). Logwatch will therefore also process
-any log-file-groups necessary to process these services. This option
-can be specified more than once to specify multiple services to process.
-A useful
-.I service-name
-is
-.I All
-which will process all services (and logfile-groups) for which you have
-filters installed.
-.IP "\fB--mailto\fR address"
-Mail the results to the email address or user specified in
-.I address.
-.IP "\fB--range\fR range"
-You can specify a date-range to process. Common ranges are
-.I Yesterday, Today, All,
-and
-.I Help.
-Additional options are listed when invoked with the
-.I Help
-parameter.
-.IP "\fB--archives\fR"
-Each log-file-group has basic logfiles (i.e. /var/log/messages) as
-well as archives (i.e. /var/log/messages.? or /var/log/messages.?.gz).
-When used with "\-\-range all", this option will make Logwatch search
-through the archives in addition to the regular logfiles. For other
-values of \-\-range, Logwatch will search the appropriate archived logs.
-.IP "\fB--debug\fR level"
-For debugging purposes.
-.I level
-can range from 0 to 100. This will
-.I really
-clutter up your output. You probably don't want to use this.
-.IP "\fB--filename\fR file-name"
-Save the output to
-.I file-name
-instead of displaying or mailing it.
-.IP "\fB--logdir\fR directory"
-Look in
-.I directory
-for log subdirectories or log files first before looking in the default directories.
-.IP "\fB--hostlimit\fR host1,host2"
-Limit report to hostname - host1, host2.
-.IP "\fB--hostname\fR hostname"
-Use
-.I hostname
-for the reports instead of this system's hostname. In addition,
-if HostLimit is set in the logwatch.conf configuration file (see
-\fBMORE INFORMATION\fR, below),
-then only logs from this hostname will be processed (where appropriate).
-.IP "\fB--html_wrap\fR num-characters"
-Number of characters that html output should be wrapped to. Default is 80.
-.IP "\fB--numeric\fR"
-Inhibits additional name lookups, displaying IP addresses numerically.
-.IP "\fB--usage\fR"
-Displays usage information
-.IP "\fB--help\fR"
-same as \-\-usage.
-.SH FILES
-.IP /usr/share/logwatch/
-.RS
-This directory contains all the perl executables and
-configuration files shipped with the logwatch distribution.
-.RE
-.IP /etc/logwatch
-.RS
-This directory contains local configuration files that override
-the default configuration. See \fBMORE INFORMATION\fR below for more
-information.
-.RE
-.SH EXAMPLES
-.B logwatch --service ftpd-xferlog --range all --detail high --archives
-.RS
-This will print out all FTP transfers that are stored in all current and archived
-xferlogs.
-.RE
-.B logwatch --service pam_pwdb --range yesterday --detail high
-.RS
-This will print out login information for the previous day...
-.RE
-.SH MORE INFORMATION
-The directory /usr/share/doc/logwatch-* contains several files with additional
-documentation:
-.RE
-.I HOWTO-Customize-LogWatch
-.RS
-Documents the directory structure of Logwatch configuration and executable
-files, and describes how to customize Logwatch by overriding these default
-files.
-.RE
-.I LICENSE
-.RS
-Describes the License under which Logwatch is distributed. Additional
-clauses may be specified in individual files.
-.RE
-.I README
-.RS
-Describes how to install, where to find it, mailing lists, and
-other useful information.
-.SH AUTHOR
-.RE
-Kirk Bauer <[email protected]>
-.RE
-http://www.kaybee.org/~kirk
-.RE
-http://logwatch.sourceforge.net
Deleted: logwatch.conf.5
===================================================================
--- logwatch.conf.5 2014-09-22 12:55:12 UTC (rev 240)
+++ logwatch.conf.5 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,37 +0,0 @@
-.\" Written by Ivana Varekova <[email protected]>.
-.TH LOGWATCH.CONF 5 2010-02-10 "GNU" "Linux Programmer's Manual"
-.SH NAME
-logwatch.conf, ignore.conf, override.conf - logwatch configuration files
-.SH DESCRIPTION
-
-.BR logwatch.conf
-- (
-.BR /etc/logwatch/conf/logwatch.conf
-)
-- can contain the local configuration options.
-The list of valid settings and their default values are in
-.BR /usr/share/logwatch/default.conf/logwatch.conf.
-
-.BR ignore.conf
-- (
-.BR /etc/logwatch/conf/ignore.conf
-)
-is the list of regular expressions.
-The set of logs decribed by this set is ignored by logwatch.
-
-.BR override.conf
-- (
-.BR /etc/logwatch/conf/override.conf
-)
-contains the settings which overrides the standard configuration
-of specific log files or services. The syntax is the same as in
-log/service files.
-
-.SH FILES
-.I /etc/logwatch/conf/logwatch.conf
-.I /etc/logwatch/conf/logwatch.conf
-.I /etc/logwatch/conf/logwatch.conf
-.I /usr/share/logwatch/default.conf/logwatch.conf
-
-.SH "SEE ALSO"
-.BR logwatch (8)
Deleted: logwatch.cron
===================================================================
--- logwatch.cron 2014-09-22 12:55:12 UTC (rev 240)
+++ logwatch.cron 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,13 +0,0 @@
-#!/bin/sh
-
-#Set logwatch location
-LOGWATCH_SCRIPT="/usr/sbin/logwatch"
-#Add options to this line. Most options should be defined in /etc/logwatch/conf/logwatch.conf,
-#but some are only for the nightly cronrun such as --output mail and should be set here.
-#Other options to consider might be "--format html" or "--encode base64", man logwatch for more details.
-OPTIONS="--output mail"
-
-#Call logwatch
-$LOGWATCH_SCRIPT $OPTIONS
-
-exit 0
Deleted: override.conf.5
===================================================================
--- override.conf.5 2014-09-22 12:55:12 UTC (rev 240)
+++ override.conf.5 2014-09-23 11:50:13 UTC (rev 241)
@@ -1 +0,0 @@
-.so man5/logwatch.conf.5
Deleted: postfix-logwatch.1
===================================================================
--- postfix-logwatch.1 2014-09-22 12:55:12 UTC (rev 240)
+++ postfix-logwatch.1 2014-09-23 11:50:13 UTC (rev 241)
@@ -1,890 +0,0 @@
-.TH POSTFIX-LOGWATCH 1
-.ad
-.fi
-.SH NAME
-postfix-logwatch
-\-
-A Postfix log parser and analysis utility
-.SH "SYNOPSIS"
-.na
-.nf
-.fi
-\fBpostfix-logwatch\fR [\fIoptions\fR] [\fIlogfile ...\fR]
-.SH DESCRIPTION
-.ad
-.fi
-The \fBpostfix-logwatch\fR(1) utility is a Postfix MTA log parser
-that produces summaries, details, and statistics regarding
-the operation of Postfix.
-.PP
-This utility can be used as a
-standalone program, or as a Logwatch filter module to produce
-Postfix summary and detailed reports from within Logwatch.
-.PP
-\fBPostfix-logwatch\fR is able to produce
-a wide range of reports with data grouped and sorted as much as possible
-to reduce noise and highlight patterns.
-Brief summary reports provide a
-quick overview of general Postfix operations and message
-delivery, calling out warnings that may require attention.
-Detailed reports provide easy to scan, hierarchically-arranged
-and organized information, with as much or little detail as
-desired.
-.PP
-\fBPostfix-logwatch\fR outputs two principal sections: a \fBSummary\fR section
-and a \fBDetailed\fR section.
-For readability and quick scanning, all event or hit counts appear in the left column,
-followed by brief description of the event type, and finally additional
-statistics or count representations may appear in the rightmost column.
-
-The following segment from a sample Summary report illustrates:
-.RS 4
-.nf
-
-****** Summary ********************************************
-
- 81 *Warning: Connection rate limit reached (anvil)
- 146 Warned
-
- 68.310M Bytes accepted 71,628,177
- 97.645M Bytes delivered 102,388,245
-======== ================================================
-
- 3464 Accepted 41.44%
- 4895 Rejected 58.56%
--------- ------------------------------------------------
- 8359 Total 100.00%
-======== ================================================
-
-.fi
-.RE 0
-The report warns that anvil's connection rate was hit 81 times,
-a Postfix access check WARN action was logged 146 times, and
-a total of 68.310 megabytes (71,628,177 bytes) were accepted
-into the Postfix system, delivering 97.645 megabytes of
-data (due to multiple recipients).
-The Accepted and Rejected lines show that Postfix accepted 3464 (41.44% of the total
-messages) and rejected 4895 (the remaining 58.56%) of the 8359
-total messages (temporary rejects show up elsewhere).
-.PP
-There are dozens of sub-sections available in the \fBDetailed\fR report, each of
-whose output can be controlled in various ways.
-Each sub-section attempts to group and present the most meaningful data at superior levels,
-while pushing less useful or \fInoisy\fR data towards inferior levels.
-The goal is to provide as much benefit as possible from smart grouping of
-data, to allow faster report scanning, pattern identification, and problem solving.
-Data is always sorted in descending order by count, and then numerically by IP address
-or alphabetically as appropriate.
-.PP
-The following MX errors segment from a sample \fBDetailed\fR report
-illustrates the basic hierarchical level structure of \fBpostfix-logwatch\fR:
-.RS 4
-.nf
-
-****** Detailed *******************************************
-
- 261 MX errors --------------------------------------
- 261 Unable to look up MX host
- 222 Host not found
- 73 foolishspammer.local
- 60 completely.bogus.domain.example
- 11 friend.example.com
- 39 No address associated with hostname
- 23 dummymx.sample.net
- 16 pushn.spam.sample.com
-
-.fi
-.RE 0
-.PP
-The \fBpostfix-logwatch\fR utility reads from STDIN or from the named Postfix
-\fIlogfile\fR.
-Multiple \fIlogfile\fR arguments may be specified, each processed
-in order.
-The user running \fBpostfix-logwatch\fR must have read permission on
-each named log file.
-.PP
-.SS Options
-The options listed below affect the operation of \fBpostfix-logwatch\fR.
-Options specified later on the command line override earlier ones.
-Any option may be abbreviated to an unambiguous length.
-
-.IP "\fB-f \fIconfig_file\fR"
-.PD 0
-.IP "\fB--config_file \fIconfig_file\fR"
-.PD
-Use an alternate configuration file \fIconfig_file\fR instead of
-the default.
-This option may be used more than once.
-Multiple configuration files will be processed in the order presented on the command line.
-See \fBCONFIGURATION FILE\fR below.
-.IP "\fB--debug \fIkeywords\fR"
-Output debug information during the operation of \fBpostfix-logwatch\fR.
-The parameter \fIkeywords\fR is one or more comma or space separated keywords.
-To obtain the list of valid keywords, use --debug xxx where xxx is any invalid keyword.
-.IP "\fB--[no]delays\fR"
-Enables (disables) output of the message delays percentiles report.
-The delays percentiles report shows percentiles for each of the 4 delivery latency times reported
-by Postfix (available in version 2.3 and later) in the form \fBdelays=\fIa\fR/\fIb\fR/\fIc\fR/\fId\fR, where
-\fIa\fR is the amount of time before the active queue (includes time for previous delivery attempts and time in the deferred queue),
-\fIb\fR is the amount of time in the active queue up to delivery agent handoff,
-\fIc\fR is the amount of time spent making connections (including DNS, HELO and TLS) and
-\fId\fR is the amount of time spent delivering the message.
-The total delay shown comes from the \fBdelay=\fR field in a message delivery log line.
-
-\fBNote:\fR This report may consume a large amount of memory; if you have no use for it, disable the delays report.
-
-.IP "\fB--delays_percentiles \fIp1 [p2 ...]\fR"
-Specifies the percentiles to be used in the message delays percentiles report.
-The percentiles \fIp1\fR, \fIp2\fR, \fI...\fR range from 0 to 100, inclusively.
-The order of the list is not sorted - the report will output the percentiles
-columns in the order you specify.
-.IP "\fB--detail \fIlevel\fR"
-Sets the maximum detail level for \fBpostfix-logwatch\fR to \fIlevel\fR.
-This option is global, overriding any other output limiters described below.
-
-The \fBpostfix-logwatch\fR utility
-produces a \fBSummary\fR section, a \fBDetailed\fR section, and
-additional report sections.
-With \fIlevel\fR less than 5, \fBpostfix-logwatch\fR will produce
-only the \fBSummary\fR section.
-At \fIlevel\fR 5 and above, the \fBDetailed\fR section, and any
-additional report sections are candidates for output.
-Each incremental increase in \fIlevel\fR generates one additional
-hierarchical sub-level of output in the \fBDetailed\fR section of the report.
-At \fIlevel\fR 10, all levels are output.
-Lines that exceed the maximum report width (specified with
-\fBmax_report_width\fR) will be cut.
-Setting \fIlevel\fR to 11 will prevent lines in the report from being cut (see also \fB--line_style\fR).
-.IP "\fB--help\fR"
-Print usage information and a brief description about command line options.
-.IP "\fB--ignore_service \fIpattern\fR"
-Ignore log lines that contain the postfix service name \fBpostfix/\fIservice\fR.
-The parameter \fIservice\fR is a regular expression.
-
-\fBNote:\fR if you use parenthesis in your regular expression, be sure they are cloistering
-and not capturing: use \fB(?:\fIpattern\fB)\fR instead of \fB(\fIpattern\fB)\fR.
-.IP "\fB--ipaddr_width \fIwidth\fR"
-Specifies that IP addresses in address/hostname pairs should be printed
-with a field width of \fIwidth\fR characters.
-Increasing the default may be useful for systems using long IPv6 addresses.
-.IP "\fB-l limiter=levelspec\fR"
-.PD 0
-.IP "\fB--limit limiter=levelspec\fR"
-.PD
-Sets the level limiter \fIlimiter\fR with the specification \fIlevelspec\fR.
-.IP "\fB--line_style \fIstyle\fR"
-Specifies how to handle long report lines.
-Three styles are available: \fBfull\fR, \fBtruncate\fR, and \fBwrap\fR.
-Setting \fIstyle\fR to \fBfull\fR will prevent cutting lines to \fBmax_report_width\fR;
-this is what occurs when \fBdetail\fR is 11 or higher.
-When \fIstyle\fR is \fBtruncate\fR (the default),
-long lines will be truncated according to \fBmax_report_width\fR.
-Setting \fIstyle\fR to \fBwrap\fR will wrap lines longer than \fBmax_report_width\fR such that
-left column hit counts are not obscured.
-This option takes precedence over the line style implied by the \fBdetail\fR level.
-The options \fB--full\fR, \fB--truncate\fR, and \fB--wrap\fR are synonyms.
-.IP "\fB--[no]long_queue_ids\fR"
-Enables (disables) interpretation of long queue IDs in Postfix (>= 2.9) logs.
-.IP "\fB--nodetail\fR"
-Disables the \fBDetailed\fR section of the report, and all supplemental reports.
-This option provides a convenient mechanism to quickly disable all sections
-under the \fBDetailed\fR report, where subsequent command line
-options may re-enable one or more sections to create specific reports.
-.IP "\fB--[no]summary\fR"
-.IP "\fB--show_summary\fR"
-Enables (disables) displaying of the the \fBSummary\fR section of the report.
-The variable Posfix_Show_Summary in used in a configuration file.
-.IP "\fB--recipient_delimiter \fIdelimiter\fR"
-Split email delivery addresses using the recipient delimiter character \fIdelimiter\fR.
-This should generally match
-the \fBrecipient_delimiter\fR specified in the Postfix parameter
-file \fBmain.cf\fR, or the default value indicated in
-\fBpostconf -d recipient_delimiter\fR.
-This is very useful for obtaining per-alias statistics
-when a recipient delimeter is used for mail delivery.
-.IP "\fB--reject_reply_patterns \fIr1 [r2 ...]\fR"
-Specifies the list of reject reply patterns used to create reject groups.
-Each entry in the list \fIr1 [r2 ...]\fR must be either a three character
-regular expression reply code of the form [45][0-9.][0-9.], or the word "Warn".
-The "." in the regular expression is a literal dot which matches any reject reply subcode;
-this wildcarding allows creation of broad rejects groups.
-List order is preserved, in that reject reports will be output in the same order as
-the entries in the list.
-Specific reject reply codes will take priority over wildcard patterns, regardless of
-the list order.
-
-The default list is "5.. 4.. Warn", which creates three groups of rejects:
-permanent rejects, temporary reject failures, and reject warnings (as in warn_if_reject).
-
-This feature allows, for example, distinguishing 421 transmission
-channel closures from 45x errors (eg. 450 mailbox unavailable, 451
-local processing errors, 452 insufficient storage).
-Such a grouping would be configured with the list: "421 4.. 5.. Warn".
-See RFC 2821 for more information about reply codes.
-
-See also \fBCONFIGURATION FILE\fR regarding using \fBreject_reply_patterns\fR within a configuration file.
-.IP "\fB--[no]sect_vars\fR"
-.PD 0
-.IP "\fB--show_sect_vars \fIboolean\fR"
-.PD
-Enables (disables) supplementing each \fBDetailed\fR section title
-with the name of that section's level limiter.
-The name displayed is the command line option (or configuration
-file variable) used to limit that section's output.
-.
-With the large number of level limiters available in \fBpostfix-logwatch\fR,
-this a convenient mechanism for determining exactly which level limiter
-affects a section.
-.IP "\fB--syslog_name \fInamepat\fR"
-Specifies the syslog service name that \fBpostfix-logwatch\fR uses
-to match syslog lines.
-Only log lines whose service name matches
-the perl regular expression \fInamepat\fR will be used by
-\fBpostfix-logwatch\fR; all non-matching lines are silently ignored.
-This is useful when a pre-installed Postfix package uses a name
-other than the default (\fBpostfix\fR), or when multiple Postfix
-instances are in use and per-instance reporting is desired.
-
-The pattern \fInamepat\fR should match the \fBsyslog_name\fR configuration
-parameter specified in the Postfix parameter file \fBmain.cf\fR, the
-master control file \fBmaster.cf\fR, or the default value as indicated
-by the output of \fBpostconf -d syslog_name\fR.
-
-\fBNote:\fR if you use parenthesis in your regular expression, be sure they are cloistering
-and not capturing: use \fB(?:\fIpattern\fB)\fR instead of \fB(\fIpattern\fB)\fR.
-.IP "\fB--[no]unknown\fR"
-.PD 0
-.IP "\fB--show_unknown \fIboolean\fR"
-.PD
-Enables (disables) display of the postfix-generated name of 'unknown' in formated IP/hostname pairs in \fBDetailed\fR reports.
-Default: enabled.
-.IP "\fB--version\fR"
-Print \fBpostfix-logwatch\fR version information.
-.SS Level Limiters
-.PP
-The output of every section in the \fBDetailed\fR report is controlled by a level limiter.
-The name of the level limiter variable will be output when the \fBsect_vars\fR option is set.
-Level limiters are set either via command line in standalone mode with \fB--limit \fIlimiter\fB=\fIlevelspec\fR option,
-or via configuration file variable \fB$postfix_\fIlimiter\fB=\fIlevelspec\fR.
-Each limiter requires a \fIlevelspec\fR argument, which is described below in \fBLEVEL CONTROL\fR.
-
-The list of level limiters is shown below.
-
-There are several level limiters that control reject sub-sections (eg. \fBrejectbody\fR, \fBrejectsender\fR, etc.).
-Because the list of reject variants is not known until runtime after \fBreject_reply_patterns\fR is seen, these reject limiters are shown below generically,
-with the prefix \fB###\fR.
-To use one of these reject limiters, substitute \fB###\fR with one of the reject reply codes in effect,
-replacing each dot with an \fBx\fR character.
-For example, using the default \fBreject_reply_patterns\fR list of "5.. 4.. Warn", three \fBrejectbody\fR variants are valid:
-\fB--limit 5xxrejectbody\fR, \fB--limit 4xxrejectbody\fR and \fB--limit warnrejectbody\fR.
-As a convenience, you may entirely eliminate the \fB###\fR prefix, and instead use the bare \fBreject\fIXXX\fR option, and
-all reject level limiter variations will be auto-generated based on the \fBreject_reply_patterns\fR list.
-For example, the command line segment:
-.nf
-
- ... --reject_reply_patterns "421 5.." \\
- --limit rejectrbl="1:10:"
-
-.fi
-would automatically become:
-.nf
-
- ... --reject_reply_patterns "421 5.." \\
- --limit 421rejectrbl="1:10:" --limit 5xxrejectrbl="1:10:"
-
-.fi
-See \fBreject_reply_patterns\fR above, and comments in the configuration file \fBpostfix-logwatch.conf\fR.
-
-.de TQ
-. br
-. ns
-. TP \\$1
-..
-
-[ THIS SECTION IS NOT YET COMPLETE ]
-
-.PD 0
-.IP "\fBAttrError"
-Errors obtaining attribute data from service.
-.IP "\fBBCCed"
-Messages that triggered access, header_checks or body_checks BCC action. (postfix 2.6 experimental branch)
-.IP "\fBBounceLocal"
-.IP "\fBBounceRemote"
-Local and remote bounces.
-A bounce is considered a local bounce if the relay was one of none, local, virtual,
-avcheck, maildrop or 127.0.0.1.
-.IP "\fBByIpRejects"
-Regrouping by client host IP address of all 5xx (permanent) reject variants.
-.IP "\fBCommunicationError"
-Postfix errors talking to one of its services.
-.IP "\fBAnvil"
-Anvil rate or concurrency limits.
-.IP "\fBConnectionInbound"
-Connections made to the \fBsmtpd\fR server.
-.IP "\fBConnectionLostInbound"
-Connections lost to the \fBsmtpd\fR server.
-.IP "\fBConnectionLostOutbound"
-Connections lost during \fBsmtp\fR communications with remote MTA.
-.IP "\fBConnectToFailure"
-Failures reported by \fBsmtp\fR when connecting to remote MTA.
-.IP "\fBDatabaseGeneration"
-Warnings noted when binary database map file requires \fBpostmap\fR update from newer source file.
-.IP "\fBDeferrals"
-.IP "\fBDeferred"
-Message delivery deferrals.
-A single \fBdeferred\fR message will have one or more \fBdeferrals\fR many times.
-.IP "\fBDeliverable"
-Address verification indicates recipient address is deliverable.
-.IP "\fBDelivered"
-Number of messages handed-off to a delivery agent such as local or virtual.
-.IP "\fBDiscarded"
-Messages that triggered access, header_checks or body_checks DISCARD action.
-.IP "\fBDNSError"
-Any one of several errors encounted during DNS lookups.
-.IP "\fBEnvelopeSenderDomains"
-List of sending domains. (2 levels: envelope sender domain, localpart)
-.IP "\fBEnvelopeSenders"
-List of envelope senders. (1 level: envelope sender)
-.IP "\fBError"
-Postfix general \fBerror\fR messages.
-.IP "\fBFatalConfigError"
-Fatal main.cf or master.cf configuration errors.
-.IP "\fBFatalError"
-Postfix general \fBfatal\fR messages.
-.IP "\fBFiltered"
-Messages that triggered access, header_checks or body_checks FILTER action.
-.IP "\fBForwarded"
-Messages forwarded by MDA for one address class to another (eg. local -> virtual).
-.IP "\fBHeloError"
-XXXXXXXXXXX
-.IP "\fBHold"
-Messages that were placed on hold by postsuper, or triggered by access, header_checks or body_checks HOLD action.
-.IP "\fBHostnameValidationError"
-Invalid hostname detected.
-.IP "\fBHostnameVerification"
-Lookup of hostname does not map back to the IP of the peer (ie. the remote system connecting to \fBsmtpd\fR).
-Also known as forward-confirmed reverse DNS (FCRDNS).
-When the reverse name has no DNS entry, the message "host not found, try again" is included; otherwise, it is not
-(e.g. when the reverse has some IP address, but not the one Postfix expects).
-.IP "\fBIllegalAddrSyntax"
-Illegal syntax in an email address provided during the MAIL FROM or RCPT TO dialog.
-.IP "\fBLdapError"
-Any LDAP errors during LDAP lookup.
-.IP "\fBMailerLoop"
-An MX lookup for the best mailer to use to deliver mail would result in a sending to ourselves.
-.IP "\fBMapProblem"
-Problem with an access table map that needs correcting.
-.IP "\fBMessageWriteError"
-Postfix encountered an error when trying to create a message file somewhere in the spool directory.
-.IP "\fBNumericHostname"
-A hostname was found that was numeric, instead of alphabetic.
-.IP "\fBPanicError"
-Postfix general \fBpanic\fR messages.
-.IP "\fBPixWorkaround"
-Workarounds were enabled to avoid remote Cisco PIX SMTP "fixups".
-.IP "\fBPolicydWeight"
-Summarization of policyweight/policydweight results.
-.IP "\fBPolicySpf"
-Summarization of PolicySPF results.
-.IP "\fBPostgrey"
-Summarization of Postgrey results.
-.IP "\fBPostscreen"
-Summarization of 2.7's postscreen and verify services.
-.IP "\fBDNSBLog"
-Summarization of 2.7's dnsblog service.
-.IP "\fBPrepended"
-Messages that triggered header_checks or body_checks PREPEND action.
-.IP "\fBProcessExit"
-Postfix services that exited unexpectedly.
-.IP "\fBProcessLimit"
-A Postfix service has reached or exceeded the maximum number of processes allowed.
-.IP "\fBQueueWriteError"
-Problems writing a Postfix queue file.
-.IP "\fBRblError"
-Lookup errors for RBLs.
-.IP "\fBRedirected"
-Messages that triggered access, header_checks or body_checks REDIRECT action.
-.IP "\fB###RejectBody"
-Messages that triggered body_checks REJECT action.
-.IP "\fB###RejectClient"
-Messages rejected by client access controls (smtpd_client_restrictions).
-.IP "\fB###RejectConfigError"
-Message rejected due to server configuration errors.
-.IP "\fB###RejectContent"
-Messages rejected by message_reject_characters.
-.IP "\fB###RejectData"
-Messages rejected at DATA stage in SMTP conversation (smtpd_data_restrictions).
-.IP "\fB###RejectEtrn"
-Messages rejected at ETRN stage in SMTP conversation (smtpd_etrn_restrictions).
-.IP "\fB###RejectHeader"
-Messages that triggered header_checks REJECT action.
-.IP "\fB###RejectHelo"
-Messages rejected at HELO/EHLO stage in SMTP conversation (smtpd_helo_restrictions).
-.IP "\fB###RejectInsufficientSpace"
-Messages rejected due to insufficient storage space.
-.IP "\fB###RejectLookupFailure"
-Messages rejected due to temporary DNS lookup failures.
-.IP "\fB###RejectMilter"
-Milter rejects. No reject reply code is available for these rejects, but an extended 5.7.1 DSN is provided.
-These rejects are forced into the generic 5xx rejects group.
-If you redefine \fBreject_reply_patterns\fR such that it does not contain the pattern \fB5..\fR, milter rejects
-will not be output.
-.IP "\fB###RejectRbl"
-Messages rejected by an RBL hit.
-.IP "\fB###RejectRecip"
-Messages rejected by recipient access controls (smtpd_recipient_restrictions).
-.IP "\fB###RejectRelay"
-Messages rejected by relay access controls.
-.IP "\fB###RejectSender"
-Messages rejected by sender access controls (smtpd_sender_restrictions).
-.IP "\fB###RejectSize"
-Messages rejected due to excessive message size.
-.IP "\fB###RejectUnknownClient"
-Messages rejected by unknown client access controls.
@@ Diff output truncated at 100000 characters. @@
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk