[Logwatch] qmail logs?

Mike Tremaine mgt at stellarcore.net
Sun Nov 7 11:33:00 MST 2004


On Sun, 2004-11-07 at 10:06, AleksCee wrote:

> The Log-Files I have configuere - the problem seems the time-
> format.... logwatch don't find the date which is looking for.... :-(
> 
> The Files lock like that:
> 
> @40000000418d88d31a250fd4 new msg 1507432
> @40000000418d88d31a252b2c info msg 1507432: bytes 1684 from 
> <??????@?????> qp 18851 uid 60000
> @40000000418d88d31a72512c starting delivery 3232: msg 1507432 to remote ????@????
> @40000000418d88d31a726c84 status: local 1/10 remote 1/20
> @40000000418d88d31a72706c delivery 3231: success: did_0+1+0/qp_18851/
> 
> 
> But logwatch search only for dates like apache-logs and normal 
> dd.mm.yyyy-Format....
> 
> thx, Alex

Obviously there is some trick to setting this up right.  I read this
somewhat "sharp" review of qmail logging.

http://www.loganalysis.org/sections/syslog/syslog-replacements/saxe-multilog.html

Which seems to suggest that you may be able to configure qmail to use
syslog or convert the logs after the fact with tai64nlocal..

You might try "logwatch.pl --range All --service qmail --print" to see
if you can get anything at all [that should ignore the date]. But since
the timestamp is so alien to logwatch I suspect that will fail also.

If you run the log through tai64nlocal first and then logwatch you might
get it to work. In this case make a new file entry in qmail.conf which
points at the output of the conversion script.

This is my best guess, Kirk or someone else who has run qmail may have
better suggestions.



-- 
Mike Tremaine
mgt at stellarcore.net
http://www.stellarcore.net



More information about the Logwatch mailing list