Table of Contents
Lire™ supports log files from six different email servers.
The log files generated by the ArGoSoft Mail Server™ are supported. For proper operation, you'll need to turn on the following components' logging:
Log SMTP commands.
Log SMTP conversations.
Log to File.
Example 10.1. ArGoSoft Mail Server™ Log Sample
3/17/2002 12:00:03 AM - SMTP connection with 10.0.0.1 [1.example.com] \ ended. ID=3342 3/17/2002 12:00:22 AM - Requested SMTP connection from 10.0.0.2 \ [2.example.com] 3/17/2002 12:00:22 AM - ( 3345) 220 ArGoSoft Mail Server Pro \ for WinNT/2000/XP, Version 1.8 (10.0.0.3) 3/17/2002 12:00:23 AM - ( 3345) HELO greed 3/17/2002 12:00:23 AM - ( 3345) 250 Welcome, 2.example.com \ [10.0.0.2], pleased to meet you 3/17/2002 12:00:23 AM - ( 3345) RSET 3/17/2002 12:00:23 AM - ( 3345) 250 Reset state 3/17/2002 12:00:23 AM - ( 3345) MAIL FROM:<john.doe.1@1.mail.example.com> 3/17/2002 12:00:23 AM - ( 3345) Checking address \ john.doe.1@1.mail.example.com 3/17/2002 12:00:23 AM - ( 3345) Address john.doe.1@1.mail.example.com \ is local
The standard log file from Exim™ is supported.
Example 10.2. Exim™ Log Sample
2001-03-27 10:00:11 exim 3.16 daemon started: pid=215, -q30m, \ listening for SMTP on port 25 2001-03-27 10:00:11 Start queue run: pid=218 2001-03-27 10:00:11 End queue run: pid=218 2001-03-27 10:08:01 Start queue run: pid=736 2001-03-27 10:08:01 End queue run: pid=736 2001-03-27 11:29:10 14hpmo-00002f-00 <= john.doe.25@1.mail.example.com \ U=root P=local S=757 2001-03-27 11:29:11 14hpmo-00002f-00 => egonw \ <john.doe.21@1.mail.example.com> D=localuser T=local_delivery 2001-03-27 11:29:11 14hpmo-00002f-00 Completed
Netscape Messaging Server™ logs its information with syslog. No special configuration is necessary.
Example 10.3. Netscape Messaging Server™ Log Sample
[08/Jan/2002:11:30:00 +0100] rodolf smtpd[29296]: \ General Information: Log created (1010485800) [08/Jan/2002:11:30:00 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7U000.J7C:\ <john.doe.1@1.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.2@1.mail.example.com>:4111:1:<john.doe.3@2.mail.example.com> [08/Jan/2002:11:30:39 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7V300.A7C:\ <john.doe.4@1.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.5@1.mail.example.com>:59347:1:<john.doe.6@2.mail.example.com> [08/Jan/2002:11:31:09 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7VX00.67E:\ <john.doe.7@3.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.8@4.mail.example.com>:4117:1:<john.doe.9@2.mail.example.com> [08/Jan/2002:11:31:26 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7WE00.D7U:\ <john.doe.10@5.mail.example.com> (added by 2.example.com.fr):\ [10.0.0.1]:1.example.com.fr:<john.doe.11@6.mail.example.com>:3278:1:\ <john.doe.12@2.mail.example.com> [08/Jan/2002:11:31:33 +0100] rodolf smtpd[29296]: \ General Notice: SMTP-Accept:GPM7WL00.F86: <john.doe.13@7.mail.example.com>:[10.0.0.1]:1.example.com.fr:\ <john.doe.14@1.mail.example.com>:998:1:<john.doe.15@2.mail.example.com>
Postfix™ logs its information with syslog. No special configuration is necessary.
Example 10.4. Postfix™ Log Sample
Dec 1 04:02:56 internetsrv postfix/pickup[20919]: 693A3578E: uid=0 from=<root> Dec 1 04:02:56 internetsrv postfix/cleanup[20921]: 693A3578E: \ message-id=<john.doe.1@example.com> Dec 1 04:02:57 internetsrv postfix/qmgr[20164]: 693A3578E: \ from=<john.doe.2@example.com>, size=617 (queue active) Dec 1 04:02:57 internetsrv postfix/cleanup[20921]: E325C578D: \ message-id=<john.doe.1@example.com> Dec 1 04:02:58 internetsrv postfix/local[20924]: 693A3578E: \ to=<john.doe.2@example.com>, relay=local, delay=3, \ status=sent (forwarded as E325C578D) Dec 1 04:02:58 internetsrv postfix/qmgr[20164]: E325C578D: \ from=<john.doe.2@example.com>, size=769 (queue active)
Lire™ accepts qmail-send Qmail™ log files where each line starts with the timestamp in numerical (with fraction) format: 982584201.511524. qmail-smtpd logfiles are not (yet) supported.
If you use multilog, you will have to filter your log file through tai64nfraq.
If you redirect your Qmail™ logs to syslog, you can run lr_desyslog (included in Lire™) to remove the extra syslog timestamp:
$ lr_desyslog qmail < qmail-syslog.log > qmail.log
Example 10.5. Qmail™ Log Sample
998545829.342079 new msg 6416 998545829.342350 info msg 6416: bytes 2657 from \ <bounce-debian-hurd=john.doe-debian-hurd=john.doe.1@1.mail.example.com> \ qp 22423 uid 71 998545829.356889 starting delivery 1808: msg 6416 to local \ john.doe.2@2.mail.example.com 998545829.357096 status: local 1/10 remote 0/20 998545829.445754 delivery 1808: success: did_0+0+1/ 998545829.445976 status: local 0/10 remote 0/20 998545829.446056 end msg 6416 998545832.186954 new msg 6416 998545832.187213 info msg 6416: bytes 1957 from \ <dns-return-13543-john-dns=john.doe.3@3.mail.example.com> qp 22431 uid 71 998545832.196806 starting delivery 1809: msg 6416 to local \ john.doe.4@2.mail.example.com
Sendmail™ logs its activity through syslog. You need to set your LogLevel to 9 or higher. Versions 8.10.x and 8.11.x of Sendmail™ are supported.
Example 10.6. Sendmail™ Log Sample
Oct 29 14:46:13 mailhost sendmail[19504]: alias database /etc/aliases \ rebuilt by root Oct 29 14:46:13 mailhost sendmail[19504]: /etc/aliases: 40 aliases, \ longest 10 bytes, 395 bytes total Oct 29 14:52:33 mailhost sendmail[19584]: alias database /etc/aliases \ rebuilt by root Oct 29 14:52:33 mailhost sendmail[19584]: /etc/aliases: 40 aliases, \ longest 10 bytes, 395 bytes total Oct 29 15:00:00 mailhost sendmail[19633]: f9U000Y19633: from=root, \ size=257, class=0, nrcpts=1, msgid=<john.doe.1@1.mail.example.com>, \ relay=john.doe.2@2.mail.example.com Oct 29 15:00:00 mailhost sendmail[19633]: f9U000Y19633: to=root, \ ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \ pri=30257, dsn=2.0.0, stat=Sent Oct 29 16:00:00 mailhost sendmail[19672]: f9U100619672: from=root, size=257, \ class=0, nrcpts=1, msgid=<john.doe.3@1.mail.example.com>, \ relay=john.doe.2@2.mail.example.com Oct 29 16:00:00 mailhost sendmail[19672]: f9U100619672: to=root, \ ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \ pri=30257, dsn=2.0.0, stat=Sent Oct 29 17:00:00 mailhost sendmail[19696]: f9U200V19696: from=root, \ size=257, class=0, nrcpts=1, msgid=<john.doe.4@1.mail.example.com>, \ relay=john.doe.2@2.mail.example.com Oct 29 17:00:00 mailhost sendmail[19696]: f9U200V19696: to=root, \ ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, \ pri=30257, dsn=2.0.0, stat=Sent