More Email Sent than "status=sent" in MailLog

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

More Email Sent than "status=sent" in MailLog

Greg Sims
Hi There,

We recently moved from RHEL 6/Postfix to CentOS 7/Postfix.  I see a change in the maillog that I need help understanding.  

We are using mailman to manage three lists totaling 21K subscribers.  Each email is sent using VERP so that the Sender and Errors-to headers are unique  -- containing an encoded version of the email address that the email is being sent to.  This helps with bounce process and the like.  The From header is the same for all of the emails sent and the To header is unique.

On the RHEL 6 system, when I count the number of "status=sent" strings in the maillog, the number is the same as the number of emails sent.  On the CentOS 7 system the number of "status=sent" is about 25% of the number of emails sent.

Can anyone help me understand this change in behavior?

Here is the command I am using to view the 4/15 emails in the maillog:

cat /var/log/maillog.processed /var/log/maillog | grep status=sent | grep 'Apr 15' | wc
   4783   85852 1221343

You can see 4,783 "status=sent" entries on Apr 15 with over 21K emails sent (and verified with DMARC aggregation).

Thanks, Greg
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: More Email Sent than "status=sent" in MailLog

Wietse Venema
Greg Sims:

> Hi There,
>
> We recently moved from RHEL 6/Postfix to CentOS 7/Postfix.  I see a change
> in the maillog that I need help understanding.
>
> We are using mailman to manage three lists totaling 21K subscribers.  Each
> email is sent using VERP so that the Sender and Errors-to headers are
> unique  -- containing an encoded version of the email address that the
> email is being sent to.  This helps with bounce process and the like.  The
> >From header is the same for all of the emails sent and the To header is
> unique.
>
> On the RHEL 6 system, when I count the number of "status=sent" strings in
> the maillog, the number is the same as the number of emails sent.  On the
> CentOS 7 system the number of "status=sent" is about 25% of the number of
> emails sent.
>
> Can anyone help me understand this change in behavior?
>
> Here is the command I am using to view the 4/15 emails in the maillog:
>
> cat /var/log/maillog.processed /var/log/maillog | grep status=sent | grep
> 'Apr 15' | wc
>    4783   85852 1221343
>
> You can see 4,783 "status=sent" entries on Apr 15 with over 21K emails sent
> (and verified with DMARC aggregation).

Perhaps system-effing-d is throttling the logs? Reportedly, it does
throttles logs before handing things off to things like rsyslogd.

        Wietse
Loading...