On 2005-07-04 12:16:01 -0400, John Peacock wrote: > Peter J. Holzer wrote: > >This patch increases the log level of the SMTP dialog from LOGDEBUG to > >LOGINFO. My log analysis scripts use the SMTP dialog as input and the > >debug files really grow too fast at log level 8. > > NOTE: Don't use numeric log levels. Please use the LOG* constants instead > so that all code is self-documenting.
I do. The only place where the numeric value is used is in the
$config/loglevel.
> You'll also note that LOGDEBUG
> internally is now 7 and not 8 (I got rid of LOGRADAR during the logging
> plugin implementation). I think the syslog levels have been kind of abused
> over the years, and we might want to make a clean break with that tradition
> and come up with a better way to delineate what we are logging (not a
> complete set by any means):
>
> LOGPROTOCOL - very low level logs (like the SMTP conversation)
> LOGINFO - higher level but still detailed (like transitions between SMTP
> phases)
> LOGERROR - a plugin couldn't continue (needs to be fixed)
> LOGWARN - a harmless error or other warnings from external apps
> LOGWHINE - qpsmtpd had to work around something that was missing that you
> might want to fix, but it will work without problem until then
> LOGSUCCESS - something went right for a change
> LOGDENY - qpsmtpd correctly blocked a message for some reason (it's not
> really a warning because everything is working fine, just the message
> violated the site's profile)
> LOGVIRUS - this may be important enough an event to justify it's own
> category (so you can compare how your various scanners are doing against
> each other)
I think I'd still want a LOGDEBUG for real debugging messages (i.e.
messages that are only interesting if you are looking for a bug), but
probably this should be enabled and disabled on a per-plugin basis, not
globally. I'm not sure about LOGVIRUS.
> Basically, rather than viewing logs as being on a continuum from harmless
> to severe (and around the bend to compulsive), collect the log lines by
> what /sort/ of thing they are logging.
Agreed.
> That being said, I'm inclined not to apply this patch (it looks like Ask
> already applied everything except the SIGCHLD and this one already),
> because IMO the SMTP-level conversation really is a LOGDEBUG sort of thing.
That's obviously open to debate. I find that I usually grep for the
protocol lines first and look at other messages only if they don't tell
me what's going on.
hp
--
_ | Peter J. Holzer | Ich sehe nun ein, dass Computer wenig
|_|_) | Sysadmin WSR | geeignet sind, um sich was zu merken.
| | | [EMAIL PROTECTED] |
__/ | http://www.hjp.at/ | -- Holger Lembke in dan-am
pgpeBknTT6S2F.pgp
Description: PGP signature
