Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
POSTFIX-LOGWATCH(1)	    General Commands Manual	   POSTFIX-LOGWATCH(1)

       postfix-logwatch	- A Postfix log	parser and analysis utility

       postfix-logwatch	[options] [logfile ...]

       The  postfix-logwatch(1)	 utility is a Postfix MTA log parser that pro-
       duces summaries,	details, and statistics	 regarding  the	 operation  of

       This utility can	be used	as a standalone	program, or as a Logwatch fil-
       ter module to produce Postfix summary and detailed reports from	within

       Postfix-logwatch	 is  able to produce a wide range of reports with data
       grouped and sorted as much as possible to reduce	 noise	and  highlight
       patterns.   Brief  summary  reports provide a quick overview of general
       Postfix operations and message delivery,	calling	out warnings that  may
       require	attention.   Detailed reports provide easy to scan, hierarchi-
       cally-arranged and organized information, with as much or little	detail
       as desired.

       Postfix-logwatch	 outputs two principal sections: a Summary section and
       a Detailed section.  For	readability and	quick scanning,	all  event  or
       hit  counts appear in the left column, followed by brief	description of
       the event type, and finally additional statistics or count  representa-
       tions may appear	in the rightmost column.

       The following segment from a sample Summary report illustrates:

	   ****** Summary ********************************************

		 81   *Warning:	Connection rate	limit reached (anvil)
		146   Warned

	     68.310M  Bytes accepted			    71,628,177
	     97.645M  Bytes delivered			   102,388,245
	   ========   ================================================

	       3464   Accepted					41.44%
	       4895   Rejected					58.56%
	   --------   ------------------------------------------------
	       8359   Total				       100.00%
	   ========   ================================================

       The report warns	that anvil's connection	rate was hit 81	times, a Post-
       fix access check	WARN action was	logged	146  times,  and  a  total  of
       68.310 megabytes	(71,628,177 bytes) were	accepted into the Postfix sys-
       tem, delivering 97.645 megabytes	of data	(due to	multiple  recipients).
       The Accepted and	Rejected lines show that Postfix accepted 3464 (41.44%
       of the total messages) and rejected 4895	(the remaining 58.56%) of  the
       8359 total messages (temporary rejects show up elsewhere).

       There are dozens	of sub-sections	available in the Detailed report, each
       of whose	output can be controlled in various  ways.   Each  sub-section
       attempts	to group and present the most meaningful data at superior lev-
       els, while pushing less useful or noisy data towards  inferior  levels.
       The  goal is to provide as much benefit as possible from	smart grouping
       of data,	to allow faster	report scanning, pattern  identification,  and
       problem	solving.   Data	is always sorted in descending order by	count,
       and then	numerically by IP address or alphabetically as appropriate.

       The following MX	errors segment from a sample  Detailed	report	illus-
       trates the basic	hierarchical level structure of	postfix-logwatch:

	   ****** Detailed *******************************************

		261   MX errors	--------------------------------------
		261	 Unable	to look	up MX host
		222	    Host not found
		 73	       foolishspammer.local
		 60	       completely.bogus.domain.example
		 39	    No address associated with hostname

       The postfix-logwatch utility reads from STDIN or	from the named Postfix
       logfile.	 Multiple logfile arguments may	be specified,  each  processed
       in  order.  The user running postfix-logwatch must have read permission
       on each named log file.

       The options listed below	affect the operation of	postfix-logwatch.  Op-
       tions  specified	 later on the command line override earlier ones.  Any
       option may be abbreviated to an unambiguous length.

       -f config_file
       --config_file config_file
	      Use an alternate configuration file config_file instead  of  the
	      default.	This option may	be used	more than once.	 Multiple con-
	      figuration files will be processed in the	order presented	on the
	      command line.  See CONFIGURATION FILE below.

       --debug keywords
	      Output  debug  information  during the operation of postfix-log-
	      watch.  The parameter keywords is	one or	more  comma  or	 space
	      separated	 keywords.   To	obtain the list	of valid keywords, use
	      --debug xxx where	xxx is any invalid keyword.

	      Enables (disables) output	of the message delays percentiles  re-
	      port.   The delays percentiles report shows percentiles for each
	      of the 4 delivery	latency	times reported by  Postfix  (available
	      in version 2.3 and later)	in the form delays=a/b/c/d, where a is
	      the amount of time before	the active queue  (includes  time  for
	      previous delivery	attempts and time in the deferred queue), b is
	      the amount of time in the	active	queue  up  to  delivery	 agent
	      handoff,	c  is the amount of time spent making connections (in-
	      cluding DNS, HELO	and TLS) and d is the amount of	time spent de-
	      livering	the message.  The total	delay shown comes from the de-
	      lay= field in a message delivery log line.

	      Note: This report	may consume a large amount of memory;  if  you
	      have no use for it, disable the delays report.

       --delays_percentiles p1 [p2 ...]
	      Specifies	 the percentiles to be used in the message delays per-
	      centiles report.	The percentiles	p1, p2,	... range  from	 0  to
	      100, inclusively.	 The order of the list is not sorted - the re-
	      port will	output the percentiles columns in the order you	 spec-

       --detail	level
	      Sets  the	 maximum  detail  level	for postfix-logwatch to	level.
	      This option is global, overriding	any other output limiters  de-
	      scribed below.

	      The  postfix-logwatch  utility produces a	Summary	section, a De-
	      tailed section, and additional report sections.  With level less
	      than  5, postfix-logwatch	will produce only the Summary section.
	      At level 5 and above, the	Detailed section, and  any  additional
	      report sections are candidates for output.  Each incremental in-
	      crease in	level generates	one additional hierarchical  sub-level
	      of  output  in the Detailed section of the report.  At level 10,
	      all levels are output.  Lines that  exceed  the  maximum	report
	      width  (specified	 with  max_report_width) will be cut.  Setting
	      level to 11 will prevent lines in	the report from	being cut (see
	      also --line_style).

       --help Print  usage  information	 and a brief description about command
	      line options.

       --ignore_service	pattern
	      Ignore log lines that contain the	 postfix  service  name	 post-
	      fix/service.  The	parameter service is a regular expression.

	      Note: if you use parenthesis in your regular expression, be sure
	      they are cloistering and not capturing: use  (?:pattern) instead
	      of (pattern).

       --ipaddr_width width
	      Specifies	 that IP addresses in address/hostname pairs should be
	      printed with a field width of width characters.  Increasing  the
	      default may be useful for	systems	using long IPv6	addresses.

       -l limiter=levelspec
       --limit limiter=levelspec
	      Sets the level limiter limiter with the specification levelspec.

       --line_style style
	      Specifies	 how  to  handle  long report lines.  Three styles are
	      available: full, truncate, and wrap.  Setting style to full will
	      prevent  cutting	lines to max_report_width; this	is what	occurs
	      when detail is 11	or higher.  When style is  truncate  (the  de-
	      fault),  long  lines  will  be  truncated	 according  to max_re-
	      port_width.  Setting style to wrap will wrap lines  longer  than
	      max_report_width	such  that  left column	hit counts are not ob-
	      scured.  This option takes precedence over the  line  style  im-
	      plied  by	the detail level.  The options --full, --truncate, and
	      --wrap are synonyms.

	      Enables (disables) interpretation	of long	queue IDs  in  Postfix
	      (>= 2.9) logs.

	      Disables	the Detailed section of	the report, and	all supplemen-
	      tal reports.  This option	provides  a  convenient	 mechanism  to
	      quickly  disable	all  sections under the	Detailed report, where
	      subsequent command line options may re-enable one	or  more  sec-
	      tions to create specific reports.


	      Enables  (disables) displaying of	the the	Summary	section	of the
	      report.  The variable Posfix_Show_Summary	in used	in a  configu-
	      ration file.

       --recipient_delimiter delimiter
	      Split  email  delivery  addresses	 using the recipient delimiter
	      character	delimiter.  This should	generally  match  the  recipi-
	      ent_delimiter  specified	in the Postfix parameter file,
	      or the default value indicated in	postconf  -d  recipient_delim-
	      iter.   This  is	very useful for	obtaining per-alias statistics
	      when a recipient delimeter is used for mail delivery.

       --reject_reply_patterns r1 [r2 ...]
	      Specifies	the list of reject reply patterns used to  create  re-
	      ject  groups.  Each entry	in the list r1 [r2 ...]	must be	either
	      a	three character	regular	expression  reply  code	 of  the  form
	      [45][0-9.][0-9.],	 or  the  word "Warn".	The "."	in the regular
	      expression is a literal dot which	matches	any reject reply  sub-
	      code;  this wildcarding allows creation of broad rejects groups.
	      List order is preserved, in that reject reports will  be	output
	      in  the  same order as the entries in the	list.  Specific	reject
	      reply codes will take priority over wildcard  patterns,  regard-
	      less of the list order.

	      The  default  list is "5.. 4.. Warn", which creates three	groups
	      of rejects: permanent rejects, temporary	reject	failures,  and
	      reject warnings (as in warn_if_reject).

	      This  feature  allows, for example, distinguishing 421 transmis-
	      sion channel closures from 45x errors (eg. 450 mailbox  unavail-
	      able,  451  local	 processing errors, 452	insufficient storage).
	      Such a grouping would be configured with the list: "421 4..  5..
	      Warn".  See RFC 2821 for more information	about reply codes.

	      See  also	 CONFIGURATION	FILE regarding using reject_reply_pat-
	      terns within a configuration file.

       --show_sect_vars	boolean
	      Enables (disables) supplementing	each  Detailed	section	 title
	      with  the	 name  of that section's level limiter.	 The name dis-
	      played is	the command line option	(or configuration  file	 vari-
	      able)  used to limit that	section's output.  With	the large num-
	      ber of level limiters available in postfix-logwatch, this	a con-
	      venient  mechanism  for  determining exactly which level limiter
	      affects a	section.

       --syslog_name namepat
	      Specifies	the syslog service name	that postfix-logwatch uses  to
	      match  syslog  lines.  Only log lines whose service name matches
	      the perl regular expression namepat will be used by postfix-log-
	      watch;  all  non-matching	 lines	are silently ignored.  This is
	      useful when a pre-installed Postfix package uses	a  name	 other
	      than  the	 default (postfix), or when multiple Postfix instances
	      are in use and per-instance reporting is desired.

	      The pattern namepat should match the  syslog_name	 configuration
	      parameter	 specified  in the Postfix parameter file, the
	      master control file, or	the default value as indicated
	      by the output of postconf	-d syslog_name.

	      Note: if you use parenthesis in your regular expression, be sure
	      they are cloistering and not capturing: use  (?:pattern) instead
	      of (pattern).

       --show_unknown boolean
	      Enables (disables) display of the	postfix-generated name of 'un-
	      known' in	formated IP/hostname pairs in Detailed	reports.   De-
	      fault: enabled.

	      Print postfix-logwatch version information.

   Level Limiters
       The  output  of every section in	the Detailed report is controlled by a
       level limiter.  The name	of the level limiter variable will  be	output
       when  the  sect_vars  option is set.  Level limiters are	set either via
       command line in standalone mode with --limit limiter=levelspec  option,
       or  via	configuration  file variable $postfix_limiter=levelspec.  Each
       limiter requires	a levelspec argument,  which  is  described  below  in

       The list	of level limiters is shown below.

       There  are several level	limiters that control reject sub-sections (eg.
       rejectbody, rejectsender, etc.).	 Because the list of  reject  variants
       is  not	known until runtime after reject_reply_patterns	is seen, these
       reject limiters are shown below generically, with the prefix  ###.   To
       use one of these	reject limiters, substitute ###	with one of the	reject
       reply codes in effect, replacing	each dot with an x character.  For ex-
       ample,  using the default reject_reply_patterns list of "5.. 4..	Warn",
       three rejectbody	variants are  valid:  --limit  5xxrejectbody,  --limit
       4xxrejectbody  and  --limit  warnrejectbody.  As	a convenience, you may
       entirely	eliminate the ### prefix, and instead use the  bare  rejectXXX
       option,	and all	reject level limiter variations	will be	auto-generated
       based on	the reject_reply_patterns list.	 For example, the command line

	   ... --reject_reply_patterns "421 5.." \
		   --limit rejectrbl="1:10:"

       would automatically become:

	   ... --reject_reply_patterns "421 5.." \
		   --limit 421rejectrbl="1:10:"	--limit	5xxrejectrbl="1:10:"

       See reject_reply_patterns above,	and comments in	the configuration file


	      Errors obtaining attribute data from service.
       BCCed  Messages that triggered access, header_checks or body_checks BCC
	      action. (postfix 2.6 experimental	branch)
	      Local and	remote bounces.	 A bounce is considered	a local	bounce
	      if the relay was one of none, local, virtual, avcheck,  maildrop
	      Regrouping  by client host IP address of all 5xx (permanent) re-
	      ject variants.
	      Postfix errors talking to	one of its services.
       Anvil  Anvil rate or concurrency	limits.
	      Connections made to the smtpd server.
	      Connections lost to the smtpd server.
	      Connections lost during smtp communications with remote MTA.
	      Failures reported	by smtp	when connecting	to remote MTA.
	      Warnings noted when binary database map  file  requires  postmap
	      update from newer	source file.
	      Message delivery deferrals.  A single deferred message will have
	      one or more deferrals many times.
	      Address verification indicates recipient address is deliverable.
	      Number of	messages handed-off to a delivery agent	such as	 local
	      or virtual.
	      Messages	that  triggered	 access,  header_checks	or body_checks
	      DISCARD action.
	      Any one of several errors	encounted during DNS lookups.
	      List of sending domains.	(2 levels: envelope sender domain, lo-
	      List of envelope senders.	 (1 level: envelope sender)
       Error  Postfix general error messages.
	      Fatal or configuration errors.
	      Postfix general fatal messages.
	      Messages	that  triggered	 access,  header_checks	or body_checks
	      FILTER action.
	      Messages forwarded by MDA	for one	address	class to another  (eg.
	      local -> virtual).
       Hold   Messages	that were placed on hold by postsuper, or triggered by
	      access, header_checks or body_checks HOLD	action.
	      Invalid hostname detected.
	      Lookup of	hostname does not map back to the IP of	the peer  (ie.
	      the  remote system connecting to smtpd).	Also known as forward-
	      confirmed	reverse	DNS (FCRDNS).  When the	reverse	 name  has  no
	      DNS  entry, the message "host not	found, try again" is included;
	      otherwise, it is not (e.g. when the reverse has some IP address,
	      but not the one Postfix expects).
	      Illegal syntax in	an email address provided during the MAIL FROM
	      or RCPT TO dialog.
	      Any LDAP errors during LDAP lookup.
	      An MX lookup for the best	mailer to use to  deliver  mail	 would
	      result in	a sending to ourselves.
	      Problem with an access table map that needs correcting.
	      Postfix  encountered  an	error  when trying to create a message
	      file somewhere in	the spool directory.
	      A	hostname was found that	was numeric, instead of	alphabetic.
	      Postfix general panic messages.
	      Workarounds were enabled to avoid	remote Cisco  PIX  SMTP	 "fix-
	      Summarization of policyweight/policydweight results.
	      Summarization of PolicySPF results.
	      Summarization of Postgrey	results.
	      Summarization of 2.7's postscreen	and verify services.
	      Summarization of 2.7's dnsblog service.
	      Messages that triggered header_checks or body_checks PREPEND ac-
	      Postfix services that exited unexpectedly.
	      A	Postfix	service	has reached or exceeded	the maximum number  of
	      processes	allowed.
	      Problems writing a Postfix queue file.
	      Lookup errors for	RBLs.
	      Messages that triggered access, header_checks or body_checks RE-
	      DIRECT action.
	      Messages that triggered body_checks REJECT action.
	      Messages rejected	by client  access  controls  (smtpd_client_re-
	      Message rejected due to server configuration errors.
	      Messages rejected	by message_reject_characters.
	      Messages	 rejected   at	 DATA	stage	in  SMTP  conversation
	      Messages	rejected  at   ETRN   stage   in   SMTP	  conversation
	      Messages that triggered header_checks REJECT action.
	      Messages	rejected  at  HELO/EHLO	 stage	in  SMTP  conversation
	      Messages rejected	due to insufficient storage space.
	      Messages rejected	due to temporary DNS lookup failures.
	      Milter rejects.  No reject reply code is available for these re-
	      jects, but an extended 5.7.1 DSN is provided.  These rejects are
	      forced into the generic 5xx rejects group.  If you redefine  re-
	      ject_reply_patterns  such	 that  it does not contain the pattern
	      5.., milter rejects will not be output.
	      Messages rejected	by an RBL hit.
	      Messages rejected	by recipient  access  controls	(smtpd_recipi-
	      Messages rejected	by relay access	controls.
	      Messages	rejected  by  sender access controls (smtpd_sender_re-
	      Messages rejected	due to excessive message size.
	      Messages rejected	by unknown client access controls.
	      Messages rejected	by unknown reverse client access controls.
	      Messages rejected	by unknown user	access controls.
	      Messages rejected	by unverified client access controls.
	      Messages rejected	dueo to	address	verification failures.
	      Messages that triggered header_checks or body_checks REPLACE ac-
	      Messages	returned  to  sender  due  to exceeding	queue lifetime
	      SASL authentication successes, includes SASL  method,  username,
	      and sender when present.
	      SASL authentication failures.
       Sent   Messages sent via	the SMTP delivery agent.
	      Messages sent via	the LMTP delivery agent.
	      Errors during the	SMTP/ESMTP dialog.
	      Protocol violation during	the SMTP/ESMTP dialog.
	      Errors during Postfix server startup.
	      Connections to smtpd that	timed out.
	      TLS client connections.
	      TLS communication	offerred.
	      TLS server connections.
	      Unverified TLS connections.
	      Address  verification  indicates recipient address is undeliver-
       Warn   Messages that triggered  access,	header_checks  or  body_checks
	      WARN action.
	      Warnings regarding Postfix configuration errors.
	      Postfix general warning messages.

       The  Detailed  section  of  the report consists of a number of sub-sec-
       tions, each of which is controlled  both	 globally  and	independently.
       Two  settings  influence	 the output provided in	the Detailed report: a
       global detail level (specified with --detail) which has final (big ham-
       mer) output-limiting control over the Detailed section, and sub-section
       specific	detail settings	(small hammer),	which allow  further  limiting
       of  the output for a sub-section.  Each sub-section may be limited to a
       specific	depth level, and each sub-level	may be limited with top	 N  or
       threshold limits.  The levelspec	argument to each of the	level limiters
       listed above is used to accomplish this.

       It is probably best to continue explanation of sub-level	limiting  with
       the  following well-known outline-style hierarchy, and some basic exam-

	   level 0
	      level 1
		 level 2
		    level 3
		       level 4
		       level 4
		 level 2
		    level 3
		       level 4
		       level 4
		       level 4
		    level 3
		       level 4
		    level 3
	      level 1
		 level 2
		    level 3
		       level 4

       The simplest form of output limiting  suppresses	 all  output  below  a
       specified  level.   For example,	a levelspec set	to "2" shows only data
       in levels 0 through 2.  Think of	this as	collapsing  each  sub-level  2
       item, thus hiding all inferior levels (3, 4, ...), to yield:

	   level 0
	      level 1
		 level 2
		 level 2
	      level 1
		 level 2

       Sometimes  the  volume  of  output in a section is too great, and it is
       useful to suppress any data that	does not exceed	 a  certain  threshold
       value.	Consider a dictionary spam attack, which produces very lengthy
       lists of	hit-once recipient email or IP addresses.  Each	 sub-level  in
       the  hierarchy can be threshold-limited by setting the levelspec	appro-
       priately.  Setting levelspec to the value "2::5"	will suppress any data
       at level	2 that does not	exceed a hit count of 5.

       Perhaps	producing a top	N list,	such as	top 10 senders,	is desired.  A
       levelspec of "3:10:" limits level 3 data	to only	the top	10 hits.

       With those simple examples out of the way, a levelspec is defined as  a
       whitespace- or comma-separated list of one or more of the following:

       l      Specifies	 the  maximum level to be output for this sub-section,
	      with a range from	0 to 10.  if l is 0, no	levels will be output,
	      effectively  disabling  the sub-section (level 0 data is already
	      provided in the Summary report, so level	1  is  considered  the
	      first  useful level in the Detailed report).  Higher values will
	      produce output up	to and including the specified level.

       l.n    Same as above, with the addition that n  limits  this  section's
	      level  1	output to the top n items.  The	value for n can	be any
	      integer greater than 1.  (This form of limiting has less utility
	      than  the	 syntax	shown below. It	is provided for	backwards com-
	      patibility; users	are encouraged to use the syntax below).

       l:n:t  This triplet specifies level l, top n, and minimum threshold  t.
	      Each  of the values are integers,	with l being the level limiter
	      as described above, n being a top	n limiter for the level	l, and
	      t	 being	the  threshold limiter for level l.  When both n and t
	      are specified, n has priority, allowing top n lists  (regardless
	      of  threshold  value).  If the value of l	is omitted, the	speci-
	      fied values for n	and/or t are used for all levels available  in
	      the sub-section.	This permits a simple form of wildcarding (eg.
	      place minimum threshold limits on	all  levels).	However,  spe-
	      cific  limiters  always  override	 wildcard limiters.  The first
	      form of level limiter may	be included in levelspec  to  restrict
	      output, regardless of how	many triplets are present.

       All  three forms	of limiters are	effective only when postfix-logwatch's
       detail level is 5 or greater (the Detailed section is not activated un-
       til detail is at	least 5).

       See the EXAMPLES	section	for usage scenarios.

       Postfix-logwatch	 can  read configuration settings from a configuration
       file.  Essentially, any command line option can be placed into  a  con-
       figuration file,	and these settings are read upon startup.

       Because	postfix-logwatch can run either	standalone or within Logwatch,
       to minimize confusion, postfix-logwatch inherits	Logwatch's  configura-
       tion file syntax	requirements and conventions.  These are:

       o   White space lines are ignored.

       o   Lines beginning with	# are ignored

       o   Settings are	of the form:

		   option = value

       o   Spaces or tabs on either side of the	= character are	ignored.

       o   Any value protected in double quotes	will be	case-preserved.

       o   All other content is	reduced	to lowercase (non-preserving, case in-

       o   All postfix-logwatch	configuration settings must be	prefixed  with
	   "$postfix_" or postfix-logwatch will	ignore them.

       o   When	 running  under	Logwatch, any values not prefixed with "$post-
	   fix_" are consumed by Logwatch; it only passes to  postfix-logwatch
	   (via	environment variable) settings it considers valid.

       o   The	values	True  and Yes are converted to 1, and False and	No are
	   converted to	0.

       o   Order of settings is	not  preserved	within	a  configuration  file
	   (since  settings  are passed	by Logwatch via	environment variables,
	   which have no defined order).

       To include a command line option	in a configuration  file,  prefix  the
       command line option name	with the word "$postfix_".  The	following con-
       figuration file setting and command line	option are equivalent:

	       $postfix_Line_Style = Truncate

	       --line_style Truncate

       Level limiters are also prefixed	with $postfix_,	 but  on  the  command
       line are	specified with the --limit option:

	       $postfix_Sent = 2

	       --limit Sent=2

       The order of command line options and configuration file	processing oc-
       curs as follows:	1) The default configuration file is read if it	exists
       and no --config_file was	specified on a command line.  2) Configuration
       files are read and processed in the order found on  the	command	 line.
       3)  Command  line  options  override any	options	already	set either via
       command line or from any	configuration file.

       Command line options are	interpreted when they are seen on the  command
       line,  and later	options	will override previously set options.  The no-
       table exception is with limiter variables, which	are interpreted	in the
       order  found,  but  only	 after	all other options have been processed.
       This allows --reject_reply_patterns to determine	the  dynamic  list  of
       the various reject limiters.

       See also	--reject_reply_patterns.

       The  postfix-logwatch  utility exits with a status code of 0, unless an
       error occurred, in which	case a non-zero	exit status is returned.

   Running Standalone
       Note: postfix-logwatch reads its	log data from one or more named	 Post-
       fix  log	 files,	or from	STDIN.	For brevity, where required, the exam-
       ples below use the word file  as	 the  command  line  argument  meaning
       /path/to/postfix.log.   Obviously you will need to substitute file with
       the appropriate path.

       To run postfix-logwatch in standalone mode, simply run:

	   postfix-logwatch file

       A complete list of options and basic usage is available via:

	   postfix-logwatch --help

       To print	a summary only report of Postfix log data:

	   postfix-logwatch --detail 1 file

       To produce a summary report and a one-level detail report for May 25th:

	   grep	'May 25' file |	postfix-logwatch --detail 5

       To produce only a top 10	list of	Sent email domains, the	summary	report
       and  detailed  reports are first	disabled.  Since commands line options
       are read	and enabled left-to-right, the Sent section is	re-enabled  to
       level 1 with a level 1 top 10 limiter:

	   postfix-logwatch --nosummary	--nodetail --limit sent='1 1:10:' file

       The  following command and its sample output shows a more complex level
       limiter example.	 The command gives the top 3 Sent email	addresses from
       the top 5 domains, in addition, all level 3 items with a	hit count of 2
       or less are suppressed (in the Sent sub-section,	 this  happens	to  be
       email's	Original  To  address).	 Ellipses indicate top N or threshold-
       limited data:

	   postfix-logwatch --nosummary	--nodetail \
		   --limit sent	'1:5: 2:3: 3::2' file

	   1762	  Sent via SMTP	-----------------------------------
	    310		joe
	     21		pooryoda3
	     11		hot93uh
	     97		buzz
	     26		leroyjones
	     14		sally
	     40		jim_jameson
	     23		sam_sampson
	     19		paul_paulson
	     44		root
	     39		jenny1
	     10		kay
	      7		ron
	      6		mrsmith

       The next	command	uses both reject_reply_patterns	and level limiters  to
       see  421	RBL rejects, threshold-limiting	level 2	output to hits greater
       than 5 (level 2 in the Reject RBL sub-section is	the  client's  IP  ad-
       dress / hostname	pair).	This makes for a very nice RBL offenders list,
       shown in	the sample output (note	the use	of the	unambiguous,  abbrevi-
       ated command line option	reject_reply_pat):

	   postfix-logwatch --reject_reply_pat '421 4..	5.. Warn' \
		   --nosummary --nodetail --limit 421rejectrbl='2 2::5'	file

	   300	 421 Reject RBL	---------------------------------------

   Running within Logwatch
       Note:  Logwatch	versions  prior	to 7.3.6, unless configured otherwise,
       required	the --print option to print to STDOUT instead of  sending  re-
       ports  via  email.   Since  version 7.3.6, STDOUT is the	default	output
       destination, and	the --print option has been replaced by	--output  std-
       out.  Check your	configuration to determine where report	output will be
       directed, and add the appropriate option	to the commands	below.

       To print	a summary report for today's Postfix log data:

	   logwatch --service postfix --range today --detail 1

       To print	a report for today's Postfix log data, with one	level
       of detail in the	Detailed section:

	   logwatch --service postfix --range today --detail 5

       To print	a report for yesterday,	with two levels	of detail in  the  De-
       tailed section:

	   logwatch --service postfix --range yesterday	--detail 6

       To  print  a report from	Dec 12th through Dec 14th, with	four levels of
       detail in the Detailed section:

	   logwatch --service postfix --range \
		   'between 12/12 and 12/14' --detail 8

       To print	a report for today, with all levels of detail:

	   logwatch --service postfix --range today --detail 10

       Same as above, but leaves long lines uncut:

	   logwatch --service postfix --range today --detail 11

       The postfix-logwatch program uses the following (automatically set) en-
       vironment variables when	running	under Logwatch:

	      This  is	the  detail  level specified with the Logwatch command
	      line argument --detail or	the Detail setting in the ...conf/ser-
	      vices/postfix.conf configuration file.

	      This is the debug	level specified	with the Logwatch command line
	      argument --debug.

	      The Logwatch program passes all settings postfix_xxx in the con-
	      figuration  file	...conf/services/postfix.conf  to  the postfix
	      filter (which is	actually  named	 .../scripts/services/postfix)
	      via environment variable.

   Standalone mode
	      The postfix-logwatch program

	      The postfix-logwatch configuration file in standalone mode

   Logwatch mode
	      The Logwatch postfix filter

	      The Logwatch postfix filter configuration	file

       logwatch(8), system log analyzer	and reporter

       README, an overview of postfix-logwatch
       Changes,	the version change list	history
       Bugs, a list of the current bugs	or other inadequacies
       Makefile, the rudimentary installer
       LICENSE,	the usage and redistribution licensing terms

       Covered under the included MIT/X-Consortium License:

       Mike Cappella

       The original postfix Logwatch filter was	written	by Kenneth Porter, and
       has had many contributors over the years.  They are entirely not	re-
       sponsible for any errors, problems or failures since the	current	au-
       thor's hands have touched the source code.



Want to link to this manual page? Use this URL:

home | help