multiple queue's in one sendmail log (was: Re: informations about sendmail logfiles)

[Dominique Bogaerts]

Hi Joost,

sorry, but I think that my explanation was not correct,

I resend you a e-mail that a I send to Arnaud Taddei

thanks again for your help

Dominique Bogaerts


Hi arnaud,

As you know, all logfiles are sent to syslog.

We run multiple sendmail on one server:

it means that you have this kind of logfile :

Oct 31 01:02:31 hostname sendmail[12737]: g9V02Tm12737: 
from=<yyyyyyyyyy at yyyyyyyyyyyyyyyy>, size=1942, class=0, nrcpts=1, 
msgid=<008401c28070$51f30a10$1a01a8c0 at neovi.com>, proto=ESMTP, 
daemon=PUBLIC, relay=mail5.etransmail5.com [207.67.131.70]
Oct 31 01:02:31 hostname sendmail[12745]: g9V02VW12745: 
from=<yyyyyyyyy at yyyyyyyyyyyyyyyyyyyyyy>, size=1979, class=0, nrcpts=1, 
msgid=<008401c28070$51f30a10$1a01a8c0 at neovi.com>, proto=ESMTP, 
daemon=OUT, relay=localhost [127.0.0.1]
Oct 31 01:02:31 hostname sendmail[12741]: g9V02Tm12737: 
to=<xxxxxxxxxxxx at xxxxxxxxxxxx>, delay=00:00:01, xdelay=00:00:00, 
mailer=esmtp, pri=31942, relay=localhost [127.0.0.1], dsn=2.0.0, 
stat=Sent (g9V02VW12745 Message accepted for delivery)
Oct 31 01:02:31 hostname sendmail[12747]: g9V02VW12745: 
to=<xxxxxxxxxxxxxxx at xxxxxxxxx>, delay=00:00:00, xdelay=00:00:00, 
mailer=esmtp, pri=31979, relay=xxxxxxxxxxxxxxxx. [999.999.999.999], 
dsn=2.0.0, stat=Sent (Mail accepted)

One sendmail ( daemon=PUBLIC )receive all internet incoming e-mail and 
sent them to a antivirus.
This antivirus forward the e-mail to a second sendmail ( daemon OUT 
)which send the e-mail to destination

So, on the logfile, we have 2 transaction for 1 e-mail : the first 
sendmail which receive ( protection anti-relay) and the second which 
send (with all redirection)

Then all statistics that we do with Lire ( and also with all statistics 
software )aren't correct because 1 e-mail count for 2 e-mail.

I know that it's a special configuration, maybe i'm not really clear 
with my explanation and also i know that it's not a "bug" in Lire but 
it's to see if this kind of feature can be done .

We are now busy to split our logfile to have "good " statistics but if 
one software can be this done, it's, of course, better for us.

thank you for your cooperation

Dominique Bogaerts




Joost van Baal wrote:

>Hi,
>
>On Thu, Jan 23, 2003 at 12:04:54PM +0100, Arnaud Taddei wrote:
>  
>
>>Dominique Bogaerts wrote:
>>    
>>
>>>We use sendmail with multiple queue to one server.
>>>
>>>the result of the logfile is a little "strange" but not surprised.
>>>
>>>Sendmail put all of his informations via Syslog. Syslog cannot permit 
>>>one logfile for one queue.
>>>
>>>So, you can imagine the result with Lire... all are twice.
>>>
>>>We don't know if we are a lot of to use sendmail with multiple queue 
>>>but we are a lot of people which use sendmail and which don't find a 
>>>suitable application to analyze the sendmail's logfile. Lire do that 
>>>greatly with a lot of useful information and fast.
>>>
>>>Is that possible to imagine this feature with Lire??
>>>      
>>>
>>Dominique, I used to run sendmail with multiple queues too but I don't 
>>understand what you mean by: 'all are twice'. Or what do you mean by 
>>'multiple queue'. Are these queues like: 1 queue for messages not 
>>delivered in the last 30 minutes, one for the ones not delivered in the 
>>last 2 hours, etc. or ??
>>    
>>
>
>I assume that's what Dominique means: a setup as given by Paul Pomes's
>re-mqueue, distributed with sendmail in the contrib/ area.
>
>When flushing one of your queue's, passing the `-L' flag to sendmail
>gives you a mean to track different queue's in your log.  E.g.:
>
> /usr/lib/sendmail -L sm-queue-2 -oQ/var/spool/mqueue2 -q
>
>Once this is done, you can split your log in separate sendmail logs,
>and feed these individualy to the Lire engine.
>
>Dominique: does that solve your problem?
>
>Bye,
>
>Joost
>
>  
>

-- 
- - - - - - - - - - - - - - -
Dominique Bogaerts
d'Ieteren s.a. - InfoDriver
Network Administrator
dominique.bogaerts at dieteren.be
- - - - - - - - - - - - - - - 




-- 
To UNSUBSCRIBE, email to questions-request at logreport.org with a subject of 
"unsubscribe". Trouble? Send an email with subject "help" to 
questions-request at logreport.org