[Logwatch] Qmail unmatched entries...

Bob Hutchinson hutchlists at midwales.com
Thu Jun 7 02:06:11 MST 2007


On Thursday 07 June 2007 9:34 am, Jan van der Merwe wrote:
> Hi Guys,
>
> We're using Amavis and Spamassassin with Qmail, would anyone have any ideas
> where these unmatched entries are coming from:
>
> --------------------- qmail-smtp Begin ------------------------
>
>
> Connections from (Threshold of 1):
> 	127.0.0.1 - 3798 Time(s)
>
> Totals:
> 	Remote connections: 3798
> 	 Local connections:
>
> **Unmatched Entries**
> tcpserver: ok 10119 xxx.xxx.xxx:127.0.0.1:10025 localhost:127.0.0.1::53160

This is coming from wherever your qmail smtpd logs are kept, mine are in
/var/log/qmail/smtpd

The reason they are not being picked up is because you are using a non-standard smtp port, 10025

This can be fixed by copying /usr/share/logwatch/scripts/services/qmail-smtpd over to /etc/logwatch/scripts/services/ and editing the latter as follows:

replace 25 in line 111 with \d+

or by applying the patch:
--- qmail-smtpd.old     2007-01-29 19:09:51.000000000 +0000
+++ qmail-smtpd 2007-06-07 09:55:59.000000000 +0100
@@ -108,7 +108,7 @@
                $TotalFrom++;
                $GrandTotalFrom++;
        }
-       elsif ( ($pid2,$LocalServer,$rest) = ( $ThisLine =~ /ok (\d+) \d+:(.*):25\s+(.*)/ ) ) {
+       elsif ( ($pid2,$LocalServer,$rest) = ( $ThisLine =~ /ok (\d+) \d+:(.*):\d+\s+(.*)/ ) ) {
                $To{$LocalServer}++;
                $TotalTo++;
                $Total++;

Please let the list know if those lines get picked up, they should be counted under 'Local connections'

>
> Thanks very much!
>
> _________________________________________________________________
> Play games, earn tickets, get cool prizes. Play now–it's FREE!
> http://club.live.com/home.aspx?icid=CLUB_hotmailtextlink1

-- 
-----------------
Bob Hutchinson
Midwales dot com
-----------------



More information about the Logwatch mailing list