excluding mailrelay in lire's sendmail report ?

[tomvo at absi.be]

Hi,

I have a difficult problem to solve with lire and sendmail reports.
Our customer has 2 mailrelays, in the past one handled inbound mail, the 
other outbound mail.
As the customer wants to have separate reports on what his customers are 
doing with their mail (outbound mail), and what comes in from the internet 
(inbound), this was quite easy. each instance of sendmail logged to its 
own syslog file, and lire could parse each file separately and produce 
separate reports.

As the mail flow has become too big, we're forced to spread inbound mail 
over both mailrelays. This causes the problem that we no longer have 
separate mail reports for in- and outbound, as the sendmail logfile now 
contains entries for both mail directions.

What we tried to do, was send via syslog all mail.* to one central 
logfile, write a script that, based on the relay= line in the first 
logfile entry of each new mail, will split the mail logfile in an inbound 
and an outbound mail file.
The idea was, that we lookup the sendmail queue id for each new mail entry 
in the logfile, grep all queue id entries and write them to another file. 
this works, but because we need to first generate a list of queue id's, 
and then grep per queue id through the entire file, parsing the file takes 
20 hours ! So it's just not feasible.

What I was wondering is, if we can manipulate lire in such a way, that it 
can both exclude and include log entries that come from a specific mail 
relay, then we could have lire run through the same sendmail file twice, 
each run with different config, and we would have the reports like we want 
them to.

Is this possible, or do you have other suggestions to solve my problem ?

kind regards,
tom.

-- 
To UNSUBSCRIBE, email to questions-request at logreport.org with a subject of 
"unsubscribe". Trouble? Send an email with subject "help" to 
questions-request at logreport.org