[OT] Slightly - Mailgraph and Postfix Log Data

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[OT] Slightly - Mailgraph and Postfix Log Data

wiskbroom
Hello;

I am in search for a way to graph my logs on four separate mailservers,
since all four are logging onto the same syslog-ng host,
I figured I'd use mailgraph, a tool which creates graphs using RRDtools.

I got rrdtools installed and ran mailgraph, and after not recieving any graph data in my database
(mailgraph.rrd file), I ran strace and saw:

write(2, "WARNING: line not in syslog form"..., 209) = 209
write(2, "WARNING: line not in syslog form"..., 167) = 167
write(2, "WARNING: line not in syslog form"..., 172) = 172
write(2, "WARNING: line not in syslog form"..., 173) = 173
write(2, "WARNING: line not in syslog form"..., 194) = 194
write(2, "WARNING: line not in syslog form"..., 172) = 172

My logs look like:

Sep 5 16:31:45 mailserver.example.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 597816CB1E: from=<[hidden email]>, size=14602, nrcpt=1 (queue active)

Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 3081A6CB1C: removed

Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 1C0426CB1D: removed

Is there a way that I can tel syslog-ng to output to two locations, on e in the format above, which I need, and another in the format that mailgraph expexts to see?

I assume that mailgraph is not setup to see the HOSTNAME/HOSTNAME entries shown above.

I am using syslog-ng, latest, and am purposely stuffing my data into files named after the host, into a directory named after the same.

Thanks all,

.vp