Table of Contents
Lire supports log files from six different email servers.
The log files generated by the ArGoSoft Mail Server™ are supported. For proper operation, you'll need to turn on the following components' logging:
Log SMTP commands.
Log SMTP conversations.
Log to File.
Example 10.1. ArGoSoft Mail Server™ Log Sample
3/17/2002 12:00:03 AM - SMTP connection with 10.0.0.1 [1.example.com] \
ended. ID=3342
3/17/2002 12:00:22 AM - Requested SMTP connection from 10.0.0.2 \
[2.example.com]
3/17/2002 12:00:22 AM - ( 3345) 220 ArGoSoft Mail Server Pro \
for WinNT/2000/XP, Version 1.8 (10.0.0.3)
3/17/2002 12:00:23 AM - ( 3345) HELO greed
3/17/2002 12:00:23 AM - ( 3345) 250 Welcome, 2.example.com \
[10.0.0.2], pleased to meet you
3/17/2002 12:00:23 AM - ( 3345) RSET
3/17/2002 12:00:23 AM - ( 3345) 250 Reset state
3/17/2002 12:00:23 AM - ( 3345) MAIL FROM:<john.doe.1@1.mail.example.com>
3/17/2002 12:00:23 AM - ( 3345) Checking address \
john.doe.1@1.mail.example.com
3/17/2002 12:00:23 AM - ( 3345) Address john.doe.1@1.mail.example.com \
is local
The standard log file from Exim™ is supported.
Example 10.2. Exim™ Log Sample
2001-03-27 10:00:11 exim 3.16 daemon started: pid=215, -q30m, \
listening for SMTP on port 25
2001-03-27 10:00:11 Start queue run: pid=218
2001-03-27 10:00:11 End queue run: pid=218
2001-03-27 10:08:01 Start queue run: pid=736
2001-03-27 10:08:01 End queue run: pid=736
2001-03-27 11:29:10 14hpmo-00002f-00 <= john.doe.25@1.mail.example.com \
U=root P=local S=757
2001-03-27 11:29:11 14hpmo-00002f-00 => egonw \
<john.doe.21@1.mail.example.com> D=localuser T=local_delivery
2001-03-27 11:29:11 14hpmo-00002f-00 Completed
Netscape Messaging Server™ logs its information with syslog. No special configuration is necessary.
Example 10.3. Netscape Messaging Server™ Log Sample
[08/Jan/2002:11:30:00 +0100] rodolf smtpd[29296]: \
General Information: Log created (1010485800)
[08/Jan/2002:11:30:00 +0100] rodolf smtpd[29296]: \
General Notice: SMTP-Accept:GPM7U000.J7C:\
<john.doe.1@1.mail.example.com>:[10.0.0.1]:1.example.com.fr:\
<john.doe.2@1.mail.example.com>:4111:1:<john.doe.3@2.mail.example.com>
[08/Jan/2002:11:30:39 +0100] rodolf smtpd[29296]: \
General Notice: SMTP-Accept:GPM7V300.A7C:\
<john.doe.4@1.mail.example.com>:[10.0.0.1]:1.example.com.fr:\
<john.doe.5@1.mail.example.com>:59347:1:<john.doe.6@2.mail.example.com>
[08/Jan/2002:11:31:09 +0100] rodolf smtpd[29296]: \
General Notice: SMTP-Accept:GPM7VX00.67E:\
<john.doe.7@3.mail.example.com>:[10.0.0.1]:1.example.com.fr:\
<john.doe.8@4.mail.example.com>:4117:1:<john.doe.9@2.mail.example.com>
[08/Jan/2002:11:31:26 +0100] rodolf smtpd[29296]: \
General Notice: SMTP-Accept:GPM7WE00.D7U:\
<john.doe.10@5.mail.example.com> (added by 2.example.com.fr):\
[10.0.0.1]:1.example.com.fr:<john.doe.11@6.mail.example.com>:3278:1:\
<john.doe.12@2.mail.example.com>
[08/Jan/2002:11:31:33 +0100] rodolf smtpd[29296]: \
General Notice: SMTP-Accept:GPM7WL00.F86:
<john.doe.13@7.mail.example.com>:[10.0.0.1]:1.example.com.fr:\
<john.doe.14@1.mail.example.com>:998:1:<john.doe.15@2.mail.example.com>
Postfix™ logs its information with syslog. No special configuration is necessary.
Example 10.4. Postfix™ Log Sample
Dec 1 04:02:56 internetsrv postfix/pickup[20919]: 693A3578E: uid=0 from=<root>
Dec 1 04:02:56 internetsrv postfix/cleanup[20921]: 693A3578E: \
message-id=<john.doe.1@example.com>
Dec 1 04:02:57 internetsrv postfix/qmgr[20164]: 693A3578E: \
from=<john.doe.2@example.com>, size=617 (queue active)
Dec 1 04:02:57 internetsrv postfix/cleanup[20921]: E325C578D: \
message-id=<john.doe.1@example.com>
Dec 1 04:02:58 internetsrv postfix/local[20924]: 693A3578E: \
to=<john.doe.2@example.com>, relay=local, delay=3, \
status=sent (forwarded as E325C578D)
Dec 1 04:02:58 internetsrv postfix/qmgr[20164]: E325C578D: \
from=<john.doe.2@example.com>, size=769 (queue active)
Lire accepts qmail-send Qmail™ log files where each line starts with the timestamp in numerical (with fraction) format: 982584201.511524. qmail-smtpd logfiles are not (yet) supported.
If you use multilog, you will have to filter your log file through tai64nfraq.
If you redirect your Qmail™ logs to syslog, you can run lr_desyslog (included in Lire) to remove the extra syslog timestamp:
$ lr_desyslog qmail < qmail-syslog.log > qmail.log
Example 10.5. Qmail™ Log Sample
998545829.342079 new msg 6416
998545829.342350 info msg 6416: bytes 2657 from \
<bounce-debian-hurd=john.doe-debian-hurd=john.doe.1@1.mail.example.com> \
qp 22423 uid 71
998545829.356889 starting delivery 1808: msg 6416 to local \
john.doe.2@2.mail.example.com
998545829.357096 status: local 1/10 remote 0/20
998545829.445754 delivery 1808: success: did_0+0+1/
998545829.445976 status: local 0/10 remote 0/20
998545829.446056 end msg 6416
998545832.186954 new msg 6416
998545832.187213 info msg 6416: bytes 1957 from \
<dns-return-13543-john-dns=john.doe.3@3.mail.example.com> qp 22431 uid 71
998545832.196806 starting delivery 1809: msg 6416 to local \
john.doe.4@2.mail.example.com
Sendmail™ logs its activity through syslog. You need to set your LogLevel to 9 or higher. Versions 8.10.x and 8.11.x of Sendmail™ are supported.
Example 10.6. Sendmail™ Log Sample
Oct 29 14:46:13 mailhost sendmail[19504]: alias database /etc/aliases \
rebuilt by root
Oct 29 14:46:13 mailhost sendmail[19504]: /etc/aliases: 40 aliases, \
longest 10 bytes, 395 bytes total
Oct 29 14:52:33 mailhost sendmail[19584]: alias database /etc/aliases \
rebuilt by root
Oct 29 14:52:33 mailhost sendmail[19584]: /etc/aliases: 40 aliases, \
longest 10 bytes, 395 bytes total
Oct 29 15:00:00 mailhost sendmail[19633]: f9U000Y19633: from=root, \
size=257, class=0, nrcpts=1, msgid=<john.doe.1@1.mail.example.com>, \
relay=john.doe.2@2.mail.example.com
Oct 29 15:00:00 mailhost sendmail[19633]: f9U000Y19633: to=root, \
ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \
pri=30257, dsn=2.0.0, stat=Sent
Oct 29 16:00:00 mailhost sendmail[19672]: f9U100619672: from=root, size=257, \
class=0, nrcpts=1, msgid=<john.doe.3@1.mail.example.com>, \
relay=john.doe.2@2.mail.example.com
Oct 29 16:00:00 mailhost sendmail[19672]: f9U100619672: to=root, \
ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \
pri=30257, dsn=2.0.0, stat=Sent
Oct 29 17:00:00 mailhost sendmail[19696]: f9U200V19696: from=root, \
size=257, class=0, nrcpts=1, msgid=<john.doe.4@1.mail.example.com>, \
relay=john.doe.2@2.mail.example.com
Oct 29 17:00:00 mailhost sendmail[19696]: f9U200V19696: to=root, \
ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \
pri=30257, dsn=2.0.0, stat=Sent