Postfix / Logwatch question

4 posts / 0 new

Topic locked

#1 Fri, 08/29/2008 - 15:56

tauvix

Postfix / Logwatch question

I installed a greylisting application to work with my postfix installation, which has dramatically reduced the amount of spam that gets processed by my server.

However, it is writing a line to the maillog file for every policy rejection - code 450 4.2.0. Is there a way to keep logwatch from reporting these? It's taken my logwatch mails from about 20k to sometimes well over 5M in size, and thus it's hard to spot real problems.

#2 Fri, 08/29/2008 - 16:19

tauvix

Following up on my own post... A slight tweaking of my google search turned up the following page: <a href='http://www.zimbra.com/forums/administrators/14453-logwatch-5-0-1-now-sen... target='_blank'>http://www.zimbra.com/forums/administrators/14453-logwatch-5-0-1-now-sen...

Following the instructions there now gives me the output of:

<div class='quote'>--------------------- Postfix Begin ------------------------

1 SASL authentication failed

47.992M Bytes accepted 50,323,641
1.220M Bytes sent via SMTP 1,278,771
48.198M Bytes delivered 50,538,988
======== ==================================================

507 Accepted 78.00%
143 Rejected 22.00%
-------- --------------------------------------------------
650 Total 100.00%
======== ==================================================

7 5xx Reject relay denied 4.90%
136 5xx Reject unknown user 95.10%
-------- --------------------------------------------------
143 Total 5xx Rejects 100.00%
======== ==================================================

7344 4xx Reject recipient address 100.00%
-------- --------------------------------------------------
7344 Total 4xx Rejects 100.00%
======== ==================================================

5850 Connections
4889 Connections lost (inbound)
20 Connections lost (outbound)
5850 Disconnections
504 Removed from queue
498 Delivered
41 Sent via SMTP
1 Resent
1 Deferred
13 Deferrals

44 Connection failure (outbound)
39 Timeout (inbound)
1 Numeric hostname
1325 Hostname verification errors
5 SASL authenticated messages

---------------------- Postfix End -------------------------</div>

Which is really all I'm looking for, just something to give me a summary of what's going on. Hopefully this will help others out as well.

#3 Fri, 08/29/2008 - 16:22 (Reply to #2)

Joe

That looks really good. ;-)

I was going to suggest a logwatch configuration change rather than disappearing the log entries (I never like to disable any event logs in the MTA--it can make it really hard to troubleshoot problems), and this is definitely nicer than just ignoring the 450 rejections.

--

Check out the forum guidelines!

#4 Fri, 08/29/2008 - 16:59 (Reply to #3)

tauvix

Oh yeah, I never wanted to stop logging the messages, just stop seeing them in my email every day :)

Topic locked