Robert Brooks wrote: > MrC wrote: >> Robert Brooks wrote: > > [..] (discussing postfix-logwatch log analyser) > >>> whilst I'm being a pain the Postfix reject figures don't show >>> rejections from before-queue amavis. Unfortunately Postfix doesn't >>> seem to log this well :( >> >> I don't use a before-queue setup, and don't know what log entries you >> have. Feel free to send the my way if you think there is any useful >> information there. I can only report on information present in the log. > > Postfix picks up the connection: > > Oct 5 09:00:54 mailhost postfix/smtpd[16844]: connect from > unknown[84.79.70.165] > Oct 5 09:00:55 mailhost postfix/smtpd[16844]: NOQUEUE: > client=unknown[84.79.70.165] > > amavis rejects the email: > > Oct 5 09:01:06 mailhost amavis[25870]: (25870-17) Blocked SPAM, > [84.79.70.165] [84.79.70.165] <[EMAIL PROTECTED]> -> > <[EMAIL PROTECTED]>, mail_id: HFW3sN8D+u30, Hits: 20.862, size: 719, > 11887 ms > > postfix logs the client disconnecting: > > Oct 5 09:01:07 mailhost postfix/smtpd[16844]: disconnect from > unknown[84.79.70.165]
This is what I expected. > > A line from Postfix along the lines of: > > Oct 5 10:58:09 mailhost postfix/smtpd[17968]: NOQUEUE: reject: RCPT > from pool-72-79-133-202.sctnpa.east.verizon.net[72.79.133.202]: Proxy > filter said "554 5.7.0 Reject, id=25870-18-2 - SPAM" > > would be perfect, I'm not sure how likely a wish it is. Doubtful. This would probably require changing postfix internals to log the fiction that it was smtpd that did the rejecting. > > Other than that you'd have to infer from the amavis log line and some > indication to postfix-logwatch of amavis's role. Without data in the log that supports such an inference, there's nothing that can be concluded. Neither utility is aware of the other and neither tries to piece together the relationship between past log entries to construct a chain of events. MrC > > I'm tempted to cross-post to postfix-users, however that's bad form. I > hope cc'ing Wietse won't incur too much wrath. > > Regards, > > Rob ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
