# pflogsumm reporting seems incorrect after postfix upgrade

## hanj

Hello

I'm using pflogsumm.pl to send me nightly reports of my postfix stats. After the recent postfix upgrade (I upgraded on Sunday), I noticed that pflogsumm is not reporting correctly.

Here is what it USE to look like:

```
messages

   3522   received

   3774   delivered

     46   forwarded

      8   deferred  (67  deferrals)

     41   bounced

  16206   rejected (81%)

      0   reject warnings

      0   held

      0   discarded (0%)

      0   bytes received

      0   bytes delivered

      0   senders

      0   sending hosts/domains

    210   recipients
```

Now.. this is what it reports:

```
messages

   6806   received

      0   delivered

      0   forwarded

      0   deferred

      0   bounced

  19489   rejected (100%)

      0   reject warnings

      0   held

      0   discarded (0%)

 470460k  bytes received

      0   bytes delivered

   1958   senders

   1377   sending hosts/domains

      0   recipients
```

Anyone else noticing this behaviour? I'm running with the following:

```
[ebuild   R   ] mail-mta/postfix-2.3.6  USE="mysql pam sasl ssl vda -cdb -dovecot-sasl -hardened -ipv6 -ldap -mailwrapper -mbox -nis -postgres (-selinux)" 2,727 kB

[ebuild   R   ] net-mail/pflogsumm-1.1.0-r1  43 kB
```

It's funny, it now reports bytes, but drops the delivered/fowarded and that affects the rejected total (i think).

Thanks!

hanji

----------

## Mr.C.

The postfix log format changed; there is a patch to pfloggsum available in the postfix source.  Apply the patch to pflogsumm.

Give the new logwatch postfix filter a try as well.

MrC

----------

## hanj

Nice!

Is the pflogsumm-conn-delays-dsn-patch the only one that needs to be applied?

Thanks!

hanji

----------

## Mr.C.

Yes, that's the one.

----------

## hanj

Sweet. Thank you very much.

hanji

----------

## hanj

hmm.. having trouble patching this file. Did you run into this?

here is my reject file:

```
less pflogsumm.pl.rej

***************

*** 696,702 ****

            }

        }

        elsif((($addr, $relay, $delay, $status, $toRmdr) = $logRmdr =~

-               /to=<([^>]*)>, (?:orig_to=<[^>]*>, )?relay=([^,]+), delay=([^,]+), status=(\S+)(.*)$/o) >= 4)

        {

            if($opts{'m'} && $addr =~ /^(.*!)*([^!]+)!([^!@]+)@([^\.]+)$/o) {

--- 696,702 ----

            }

        }

        elsif((($addr, $relay, $delay, $status, $toRmdr) = $logRmdr =~

+               /to=<([^>]*)>, (?:orig_to=<[^>]*>, )?relay=([^,]+), (?:conn_use=[^,]+, )?delay=([^,]+), (?:delays=[^,]+, )?(?:dsn=[^,]+, )?status=

(\S+)(.*)$/o) >= 4)

        {

            if($opts{'m'} && $addr =~ /^(.*!)*([^!]+)!([^!@]+)@([^\.]+)$/o) {
```

Or did you just do it by hand?

thanks

hanji

----------

## Mr.C.

The patch runs cleanly against the 1.1.0 version of pflogsumm.  Download from here if you aren't sure:

http://jimsun.linxnet.com/downloads/pflogsumm-1.1.0.tar.gz

MrC

----------

## hanj

Actually, the line it's trying to change is the the same as what I currently have.

```
#       /to=<([^>]*)>, (?:orig_to=<[^>]*>, )?relay=([^,]+), (?:conn_use=[^,]+, )?delay=([^,]+), (?:delays=[^,]+, )?(?:dsn=[^,]+,)?status=(\S+)(.*)$/o) >= 4)

                /to=<([^>]*)>, (?:orig_to=<[^>]*>, )?relay=([^,]+), (?:conn_use=[^,]+, )?delay=([^,]+), (?:delays=[^,]+, )?(?:dsn=[^,]+, )?status=

(\S+)(.*)$/o) >= 4)

```

version of pflogsumm (pflogsumm-1.1.0-r1)

Thanks!

hanji

----------

## hanj

Looks like 1.1.0-r1 already applies this patch (1.1.0-postfix-2.3-logs.patch). So my version is still not liking the recent postfix update.

hanji

----------

## Mr.C.

Can you send me a couple of lines from your maillog ?  I'll take a look to see what's different about your logs, and will run it against my new logwatch filter.  PM if you prefer.

----------

## overkll

I have the same issue.  The patch in the ebuild is incorrect.

The ebuild patch has this line:

 *Quote:*   

> +               /to=<([^>]*)>, (?:orig_to=<[^>]*>, )?relay=([^,]+), (?:conn_use=
> 
> [^,]+, )?delay=([^,]+), (?:delays=[^,]+, )?(?:dsn=[^,]+,)?status=(\S+)(.*)$/o) >
> 
> = 4)

 

The pflogsumm patch included with postfix has this line:

 *Quote:*   

> +               /to=<([^>]*)>, (?:orig_to=<[^>]*>, )?relay=([^,]+), (?:conn_use=
> 
> [^,]+, )?delay=([^,]+), (?:delays=[^,]+, )?(?:dsn=[^,]+, )?status=(\S+)(.*)$/o) >
> 
> = 4)

 

That space makes the "delivered" work.

EDIT: filed bug report - bug 168766Last edited by overkll on Wed Feb 28, 2007 6:17 pm; edited 1 time in total

----------

## Mr.C.

Yes, it would.  The space is always present after the DSN's comma.

Who mucked that up!

----------

## overkll

 *Mr.C. wrote:*   

> The postfix log format changed; there is a patch to pfloggsum available in the postfix source.  Apply the patch to pflogsumm.
> 
> Give the new logwatch postfix filter a try as well.
> 
> MrC

 

What new logwatch postfix filter?  I have logwatch-7.3-r1 and the postfix section spews forth EVERY connection!  Makes for a quite large report.  Previously, it only showed "unmatched" entries there.

EDIT: Never mind.  Just made an overlay ebuild for logwatch-7.3.4.  NOW THAT'S MORE LIKE IT  :Very Happy: 

----------

## Mr.C.

I rewrote the entire postfix and amavis filters for logwatch.  The 7.3.4 version of logwatch contains the new filter, which you've found.  However, I found a couple of fixes, and added something for an upcoming postfix 2.4 release.

Pick up the latest version at :

http://www.mikecappella.com/logwatch/postfix.tgz

or in the logwatch CVS repository ( I just checked in the latest version of the amavis and postfix filters today).

The advantage to using the postfix.tgz package above is that it comes with a README and Changes so you can see some of the customization you can do to expand or reduce the detailed sections.

MrC

----------

