Status of Pflogsumm Maintenance

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Status of Pflogsumm Maintenance

Jim Seymour-2
Good day, everybody.

Back in October, 2007, Tony Earnshaw <[hidden email]> wrote:
> Considering that Jim Seymour (Jimsun) of pflogsumm fame has moved on to
> greater things (whatever they are) and Mike Capella is largely unknown
> to the universe:
>
> I and a gazillion others are utterly dependent on pflogsumm for daily
> analysis of Postfix logs.
[snip]
>
> It would be a dead shame if any Postfix logging mods, in time, ruined
> either of the two above.

And, more recently, there was this:

[hidden email] (Wietse Venema) wrote:

>
> Stefan `Sec` Zehl:
> > The question is, should postfix always keep the ")" at the end of these
> > lines, or should pflogsumm be fixed not to expect it? I can produce a
> > patch for both things if a consensus is found about this ;)
>
> pflogsumm should not get confused.
>
> Wietse
>

It's true I'm not currently active in the "Postfix community."  And it's
true I'm not much inclined to add *enhancements* to Pflogsumm, lately.
But I *do* plan to keep Pflogsumm functional.  After all: I use
Pflogsumm myself ;), and I do eventually upgrade my Postfix
installation.  So if the logfile format, as emitted by Postfix,
changes, somebody please let me know, perhaps send me some logfile
entries, maybe even a suggested patch (for which you'll get credit, if
I use it) and I'll make sure Pflogsumm remains useful.

Btw: Mailing list traffic must include "pflogsumm" in the Subject
or body for me to notice it.  Best if you email me directly, tho.  Or
use the web form noted below.

Thanks,
Jim
--
Note: My mail server employs *very* aggressive anti-spam
filtering.  If you reply to this email and your email is
rejected, please accept my apologies and let me know via my
web form at <http://jimsun.linxnet.com/contact/scform.php>.
Reply | Threaded
Open this post in threaded view
|

Re: Status of Pflogsumm Maintenance

Victor Duchovni
On Mon, May 26, 2008 at 08:49:06AM -0400, Jim Seymour wrote:

> It's true I'm not currently active in the "Postfix community."  And it's
> true I'm not much inclined to add *enhancements* to Pflogsumm, lately.
> But I *do* plan to keep Pflogsumm functional.  After all: I use
> Pflogsumm myself ;), and I do eventually upgrade my Postfix
> installation.  So if the logfile format, as emitted by Postfix,
> changes, somebody please let me know, perhaps send me some logfile
> entries, maybe even a suggested patch (for which you'll get credit, if
> I use it) and I'll make sure Pflogsumm remains useful.

The log format has not changed, but this is an edge case, "long" entries
get truncated, and may not include content usually expected at the
end of similar "short" entries.

In particular,

        postfix/smtp[12345]: id: to=<...>, ... (host foo said: ...

may not end with the expected number of ")" characters or include some
or all of the (in reply TO ...) context.

    2008-05-27T13:00:29-0400 amnesiac postfix/smtp[2862]: 5A2654802E:
    to=<[hidden email]>,
    relay=alt1.gmr-smtp-in.l.google.com[209.85.147.14]:25, delay=227374,
    delays=227372/0/1.6/0.2, dsn=4.7.0, status=deferred
    (host alt1.gmr-smtp-in.l.google.com[209.85.147.14] said:
    421 4.7.0 Try again later, closing connection. (MAIL) k36si112137800waf.0
    (in reply to MAIL FROM command))

If the log entry were longer (1-2K in size), it could be truncated somewhere
after "said:" and before the final "))".

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:[hidden email]?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.