On Thu, 23 Nov 2006, Chris Lightfoot wrote: > On Thu, Nov 23, 2006 at 05:02:40PM +0100, Stanislaw Halik wrote: > > I'm having a problem with log parsing. I'm trying to take some > > assumptions, I'd like you to correct or confirm them. > > > > Field `H=' contains connecting host name. If host doesn't resolve and > [...] > > your best bet is probably to read the bit of the source > that generates those lines -- src/deliver.c looks like it > from a quick grep.
Or how about reading the documentation? There's a whole chapter called "Log files", which has a section called "Logging message reception". Are these hard to find? Therein is the paragraph you seek: For messages from other hosts, the H and U fields identify the remote host and record the RFC 1413 identity of the user that sent the message, if one was received. The number given in square brackets is the IP address of the sending host. If there is a single, unparenthesized host name in the H field, as above, it has been verified to correspond to the IP address (see the host_lookup option). If the name is in parentheses, it was the name quoted by the remote host in the SMTP HELO or EHLO command, and has not been verified. If verification yields a different name to that given for HELO or EHLO, the verified name appears first, followed by the HELO or EHLO name in parentheses. All you need to "assume" is that the documentation correct. <grin> -- Philip Hazel University of Cambridge Computing Service Get the Exim 4 book: http://www.uit.co.uk/exim-book -- ## List details at http://www.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://www.exim.org/eximwiki/
