Table of Contents
Lire supports log files from four different email servers.
The standard log file from Exim are supported.
Example 8.1. Exim Log Sample
2001-03-27 10:00:11 exim 3.16 daemon started: pid=215, -q30m, \ listening for SMTP on port 25 2001-03-27 10:00:11 Start queue run: pid=218 2001-03-27 10:00:11 End queue run: pid=218 2001-03-27 10:08:01 Start queue run: pid=736 2001-03-27 10:08:01 End queue run: pid=736 2001-03-27 11:29:10 14hpmo-00002f-00 <= john.doe.25@1.mail.example.com \ U=root P=local S=757 2001-03-27 11:29:11 14hpmo-00002f-00 => egonw \ <john.doe.21@1.mail.example.com> D=localuser T=local_delivery 2001-03-27 11:29:11 14hpmo-00002f-00 Completed
Netscape Messaging Server logs its information with syslog. No special configuration is necessary.
Example 8.2. Netscape Messaging Server Log Sample
[08/Jan/2002:11:30:00 +0100] rodolf smtpd[29296]: \ General Information: Log created (1010485800) [08/Jan/2002:11:30:00 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7U000.J7C:\ <john.doe.1@1.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.2@1.mail.example.com>:4111:1:<john.doe.3@2.mail.example.com> [08/Jan/2002:11:30:39 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7V300.A7C:\ <john.doe.4@1.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.5@1.mail.example.com>:59347:1:<john.doe.6@2.mail.example.com> [08/Jan/2002:11:31:09 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7VX00.67E:\ <john.doe.7@3.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.8@4.mail.example.com>:4117:1:<john.doe.9@2.mail.example.com> [08/Jan/2002:11:31:26 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7WE00.D7U:\ <john.doe.10@5.mail.example.com> (added by 2.example.com.fr):\ [10.0.0.1]:1.example.com.fr:<john.doe.11@6.mail.example.com>:3278:1:\ <john.doe.12@2.mail.example.com> [08/Jan/2002:11:31:33 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7WL00.F86: <john.doe.13@7.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.14@1.mail.example.com>:998:1:<john.doe.15@2.mail.example.com>
Postfix logs its information with syslog. No special configuration is necessary.
Example 8.3. Postfix Log Sample
Dec 1 04:02:56 internetsrv postfix/pickup[20919]: 693A3578E: uid=0 from=<root> Dec 1 04:02:56 internetsrv postfix/cleanup[20921]: 693A3578E: \ message-id=<john.doe.1@example.com> Dec 1 04:02:57 internetsrv postfix/qmgr[20164]: 693A3578E: \ from=<john.doe.2@example.com>, size=617 (queue active) Dec 1 04:02:57 internetsrv postfix/cleanup[20921]: E325C578D: \ message-id=<john.doe.1@example.com> Dec 1 04:02:58 internetsrv postfix/local[20924]: 693A3578E: \ to=<john.doe.2@example.com>, relay=local, delay=3, \ status=sent (forwarded as E325C578D) Dec 1 04:02:58 internetsrv postfix/qmgr[20164]: E325C578D: \ from=<john.doe.2@example.com>, size=769 (queue active)
Lire accepts qmail-send Qmail log files where each line starts with the timestamp in numerical (with fraction) format: 982584201.511524. qmail-smtpd logfiles are not (yet) supported.
If you use multilog, you will have to filter your log file through tai64nfraq.
If you redirect your Qmail logs to syslog, you can run lr_desyslog (included in Lire) to remove the extra syslog timestamp:
$ lr_desyslog qmail < qmail-syslog.log > qmail.log
Example 8.4. Qmail Log Sample
998545829.342079 new msg 6416 998545829.342350 info msg 6416: bytes 2657 from \ <bounce-debian-hurd=john.doe-debian-hurd=john.doe.1@1.mail.example.com> \ qp 22423 uid 71 998545829.356889 starting delivery 1808: msg 6416 to local \ john.doe.2@2.mail.example.com 998545829.357096 status: local 1/10 remote 0/20 998545829.445754 delivery 1808: success: did_0+0+1/ 998545829.445976 status: local 0/10 remote 0/20 998545829.446056 end msg 6416 998545832.186954 new msg 6416 998545832.187213 info msg 6416: bytes 1957 from \ <dns-return-13543-john-dns=john.doe.3@3.mail.example.com> qp 22431 uid 71 998545832.196806 starting delivery 1809: msg 6416 to local \ john.doe.4@2.mail.example.com
Sendmail logs its activity through syslog. You need to set your LogLevel to 9 or higher. Versions 8.10.x and 8.11.x of Sendmail are supported.
Example 8.5. Sendmail Log Sample
Oct 29 14:46:13 mailhost sendmail[19504]: alias database /etc/aliases \ rebuilt by root Oct 29 14:46:13 mailhost sendmail[19504]: /etc/aliases: 40 aliases, \ longest 10 bytes, 395 bytes total Oct 29 14:52:33 mailhost sendmail[19584]: alias database /etc/aliases \ rebuilt by root Oct 29 14:52:33 mailhost sendmail[19584]: /etc/aliases: 40 aliases, \ longest 10 bytes, 395 bytes total Oct 29 15:00:00 mailhost sendmail[19633]: f9U000Y19633: from=root, \ size=257, class=0, nrcpts=1, msgid=<john.doe.1@1.mail.example.com>, \ relay=john.doe.2@2.mail.example.com Oct 29 15:00:00 mailhost sendmail[19633]: f9U000Y19633: to=root, \ ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \ pri=30257, dsn=2.0.0, stat=Sent Oct 29 16:00:00 mailhost sendmail[19672]: f9U100619672: from=root, size=257, \ class=0, nrcpts=1, msgid=<john.doe.3@1.mail.example.com>, \ relay=john.doe.2@2.mail.example.com Oct 29 16:00:00 mailhost sendmail[19672]: f9U100619672: to=root, \ ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \ pri=30257, dsn=2.0.0, stat=Sent Oct 29 17:00:00 mailhost sendmail[19696]: f9U200V19696: from=root, \ size=257, class=0, nrcpts=1, msgid=<john.doe.4@1.mail.example.com>, \ relay=john.doe.2@2.mail.example.com Oct 29 17:00:00 mailhost sendmail[19696]: f9U200V19696: to=root, \ ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \ pri=30257, dsn=2.0.0, stat=Sent