feed for update notifications.]
+rel-1.3.0 2026-09-15
+
+ Promoted 1.3.0beta01 to Production with no code changes.
+
+ Summary of important changes since the 1.2.0 Production release:
+
+ Minor reject messages improvement: Now includes client domain or
+ IP address in "Sender address rejected..." reports and --rej-add-to
+ will add the intended destination address.
+
+ Now catches "removed (canceled)" log entries. Such messages are
+ no longer counted as received.
+
+ New Grand Totals value added: "removed (canceled)"
+
+ Added --suppress <report(s)> option, allowing one to suppress
+ selected report sections. Current report section options are:
+
+ host/domain - suppress all host/domain summaries
+
+ per-hour - suppress all per-hour/-day statistics
+
+ rdns-warnings - suppress all "does not resolve to address" rDNS
+ warnings
+
+ size-detail - suppress per-user message size detail
+
+ "--suppress help" lists the available report suppression options
+
+ Several documentation changes and updates.
+
+ See the rel-1.2.1 through rel-1.3.0beta01 entries below for development
+ and pre-release history.
+
+rel-1.3.0beta01 20260820
+
+ Other than the below-noted documentation updates, this is simply a
+ promotion of 1.2.2alpha02 to Beta status.
+
+ Documentation Updates:
+
+ - pflogsumm-faq.txt renamed to FAQ and extensively updated
+ - README renamed to INSTALL and updated
+ - README.md created
+ - ToDo renamed to TODO
+
+ Version Numbering Change
+
+ With this release there will be a change in the way pflogsumm
+ versioning is done.
+
+ - Rather than bumping the third digit of version numbers for Alpha
+ or Beta releases, new Alpha and Beta releases will take the next
+ Production release's version number, with "alphaNN" or "betaNN"
+ appended.
+ - The last digit of the version number will be reserved for patch
+ releases. Alpha and Beta versions of a patch release will retain
+ that patch version through Production.
+
+ I decided on this approach after discovering some consumers were
+ mistaking Beta releases for Production releases.
+
+rel-1.2.2alpha02 20260815
+
+ Added --suppress <report(s)> option, allowing one to suppress selected
+ report sections. Current report section options are:
+
+ host/domain - suppress all host/domain summaries
+ per-hour - suppress all per-hour/-day statistics
+ rdns-warnings - suppress all "does not resolve to address" rDNS
+ warnings
+ size-detail - suppress per-user message size detail
+
+ "--suppress help" lists the available report suppression options
+
+rel-1.2.2alpha01 20260814
+
+ Now catches "removed (canceled)" log entries. Such messages are no
+ longer counted as received.
+
+ New Grand Totals value added: "removed (canceled)"
+
rel-1.2.1 20260422
This release begins the next Beta cycle following the 1.2.0 Production
--- /dev/null
+
+FAQ for pflogsumm - A Log Summarizer/Analyzer for the Postfix MTA
+
+Introduction
+
+ I wouldn't have believed it. What started out mostly as a light-
+ hearted exercise in improving my facility with Perl--with the hope
+ that something useful would come out of it as well--has turned out to
+ be a somewhat popular utility. And as more Admins find out about
+ postfix, and more end up trying pflogsumm, many of the questions,
+ suggestions, and enhancement requests are becoming "frequently
+ asked". So odd as it seems (to me, at any rate), it looks like it's
+ time for a FAQ.
+
+
+Index of pflogsumm Frequently Asked Questions (in no particular order)
+
+ 1. Project Status
+ 2. "Could You Make" or "Here's A Patch To Make" pflogsumm Do ...
+ 3. Built-In Support for Compressed Logs
+ 4. Processing Multiple Log Files
+ 5. By-domain Listings
+ 6. Reject, Deferred and Bounced Detail Info
+ 7. "Orphaned" (no size) Messages
+ 8. pflogsumm misses/mis-diagnoses/mis-reports, etc. <whatever>
+ 9. pflogsumm just doesn't work or doesn't report anything
+ 10. Postfix Rejects pflogsumm Reports Because Of Body Checks
+ 11. pflogsumm Reports Double Traffic When Anti-Virus Scanner Used
+ 12. pflogsumm's numbers don't add up
+ 13. Hourly stats for reports run without "-d" option are halved
+ 14. How Do I Get pflogsumm To Email Reports To Me Daily/Weekly/etc.?
+ 15. How Can I View pflogsumm's Reports In My Web Browser?
+ 16. How can I best format my custom reject messages for display in
+ pflogsumm's output?
+ 17. pflogsumm doesn't understand my log file format
+ 18. Why Isn't There Any Mention Of "Monkey Butler" In The FAQ?
+ 19. Translating pflogsumm (Support for Internationalization)
+ 20. Sending Logfile Samples
+ 21. From Where Can I Obtain pflogsumm?
+
+
+1. Project Status
+
+ After a 20-year hiatus from pflogsumm development, in 2025 I returned
+ to actively developing it. Since then there have been several Alpha,
+ Beta, and Production releases.
+
+2. "Could You Make" or "Here's A Patch To Make" pflogsumm Do ...
+
+ To the argument "But it's a patch, all you have to do is...," the
+ answer is: "Not quite." Every time I make a change to pflogsumm I
+ have to run it through a series of regression checks to make sure the
+ change didn't break something. Then there's the commit,
+ documentation, web page update, etc. cycle.
+
+ I'm particularly unlikely to add code to pflogsumm to account for
+ non-standard Postfix log entries. "Non-standard" being defined as
+ "other than what Wietse's code does." Or additional stats gathering
+ that nobody else has requested and strikes *me* as of limited interest
+ or use. In addition to the development cycle, there's the issue of
+ "code bloat." pflogsumm already takes enough (too much?) time and
+ memory on busy machines with large logs. I'm not prone to make this
+ worse for the sake of these things.
+
+ See Also: 17. pflogsumm doesn't understand my log file format
+
+3. Built-In Support for Compressed Logs
+
+ I took a look at this. There is a Perl module (which I downloaded,
+ built, and installed here) to interface to libz, but after considering
+ the changes that would be necessary--and the fact that those changes
+ would require that potential users have to download/build/install libz
+ (and of the correct version) and the additional Perl module, I decided
+ to forego this enhancement.
+
+ I could just open a pipe within pflogsumm and use zcat/gunzip/gzip.
+ That would depend upon a) them being there [probably a safe bet--
+ considering the logs somehow got into that format :-), but...] and b)
+ one of these either being in the path or having an environment
+ variable or a script variable or...
+
+ The thing is, in the latter case there's really no "savings" over
+ simply piping into pflogsumm in the first place. Multiple processes
+ get spawned, pipes opened, etc. either way. It would add a little
+ convenience, is all.
+
+ So I could do it. And there are a couple of ways I could do it. And
+ my mind is certainly still open on the issue. I'm just not convinced
+ there's a good reason to do it, is all. And I'd like to avoid
+ "creeping over-feature-itis" if I can. My position is *not* set in
+ stone on this issue. In the mean-time:
+
+ zcat /var/log/maillog.0.gz |pflogsumm <args...>
+
+ or
+
+ gunzip </var/log/maillog.0.gz |pflogsumm <args...>
+
+ should do the trick quite nicely for you.
+
+ If you've a complex situation, for example: your logs aren't rotated
+ exactly at midnight, you might try something like:
+
+ (zcat /var/log/maillog.0.gz; cat /var/log/maillog) \
+ |pflogsumm -d yesterday
+
+ See Also: 4. Processing Multiple Log Files
+ 14. How Do I Get pflogsumm To Email Reports To Me
+ Daily/Weekly/etc.?
+
+
+4. Processing Multiple Log Files
+
+ When processing multiple log files (say: an entire weeks worth of logs
+ that are rotated daily), it is important that pflogsumm be fed them in
+ chronological order. For performance and memory conservation reasons,
+ pflogsumm relies on log messages "arriving" in the order in which they
+ were created.
+
+ If you do something like this:
+
+ pflogsumm /var/log/maillog*
+
+ you might not get what you expect! Instead, try something like:
+
+ pflogsumm `ls -rt /var/log/maillog*`
+
+ A more complex example, where compressed logs are involved:
+
+ (zcat `ls -rt /var/log/maillog.*.gz`; cat /var/log/maillog) \
+ |pflogsumm
+
+ Obviously, this depends on the file modification times for your logs
+ being reflective of their chronological order. If that can't be
+ trusted, you're gonna have to get ugly. Like in enumerating each
+ file, or as in:
+
+ (for each in 3 2 1 0; do
+ zcat "/var/log/maillog.$each.gz"
+ done
+ cat /var/log/maillog) |pflogsumm
+
+ or (somewhat more efficiently--by running zcat only once):
+
+ (zcat `for ea in 3 2 1 0; do echo "/var/log/maillog.$ea.gz";
+ done`; cat /var/log/maillog) |pflogsumm
+
+ [Note: I didn't actually run these. So you would be well-advised
+ to double-check them.]
+
+ See Also: 3. Built-In Support for Compressed Logs
+ 14. How Do I Get pflogsumm To Email Reports To Me
+ Daily/Weekly/etc.?
+
+
+5. By-domain Listings
+
+ I figured on the desire for this one from the start. There are many
+ possibilities:
+
+ 1) A single report, split by domain
+ 2) An option to limit reporting to a particular domain
+
+ This issue is kind of tricky. The popularity of Unix amongst
+ SysAdmins is testimony to the beauty of being able to wire- together
+ small, simple tools so that one can generate output to ones taste.
+ Anything I do is likely to make some Admins happy and others wishing
+ I'd done it "the other way".
+
+ One thought that occurred is to perhaps provide a couple of options
+ that would allow one to limit a particular report to
+
+ sender=regular_expression and/or recipient=regular_expression
+
+ The problem with this solution is that an Admin desiring to emit
+ custom reports for multiple domains would have to re-process the same
+ log multiple times--once for each desired domain.
+
+ So I'm still thinking about this one.
+
+
+6. Reject, Deferred and Bounced Detail Info
+
+ I've actually only received one query about this so far, but there are
+ bound to be more. So...
+
+ The "detailed" information in the "Reject", "Deferred" and "Bounced"
+ reports is a compromise. Just take a stroll through your postfix logs
+ some day and observe the variation in how the "reason" for a
+ particular reject, defer, or bounce is reported. Without putting a
+ lot of static comparisons for each-and-every case into the analyzer, I
+ have absolutely no hope of doing this very well.
+
+ Emitting the entire "reason" is not good, either. The entire "reason"
+ string can be very long. Depending on what somebody is using to
+ display pflogsumm's output, the lines may well wrap-- producing output
+ that is no more readable than just grepping the logs.
+
+ And anything more I do to this end may soon be rendered moot. After
+ Wietse gets most of the more important functional stuff out of the
+ way, Postfix logging is going to be completely re-written. (Oh boy,
+ won't that be fun!) I'm hoping I'll be able to get some input into
+ the process so the formatting is more amenable to automated
+ processing. Wietse has indicated that such would be the case.
+
+ Also, please note my primary objective behind pflogsumm (besides the
+ entertainment value): "just enough detail to give the administrator a
+ ``heads up'' for potential trouble spots." It's not *supposed* to do
+ away with manual inspection entirely.
+
+ For those that really want all that extra detail in the log summary
+ reports, specify the "--verbose-msg-detail" switch.
+
+ See Also: 20. Sending Logfile Samples
+
+
+7. "Orphaned" (no size) Messages
+
+ The Problem:
+
+ Message size is reported only by the queue manager. The message
+ may be delivered long-enough after the (last) qmgr log entry that
+ the information is not in the log(s) processed by a particular run
+ of pflogsumm.
+
+ The Result:
+
+ "Orphaned" messages. These are reported by pflogsumm as "Messages
+ with no size data."
+
+ This, of course, throws off "Recipients by message size" and the
+ total for "bytes delivered." ("bytes in messages" in earlier
+ versions.)
+
+ The Solution:
+
+ "Memorize" message sizes by queue i.d. Easy in theory. Difficult
+ in practice. At least at the moment.
+
+ You see, if pflogsumm's going to "memorize" message sizes, it has
+ to have some definitive way to know when to delete a no-
+ longer-needed reference. Otherwise the memory file will just grow
+ forever.
+
+ As with the "Reject, Deferred and Bounced Detail Info" issue above,
+ I'm hoping to get some input into future changes in logging issues.
+ In any event: maybe whatever comes out of the logging redesign will
+ provide a solution.
+
+ As of pflogsumm version 1.0.12, the "Messages with no size data" report
+ can be turned off.
+
+
+8. pflogsumm misses/mis-diagnoses/mis-reports, etc. <whatever>
+
+ Are you processing your log files in chronological order? See item
+ "4: "Processing Multiple Log Files".
+
+ pflogsumm is being developed by me on my rather small-scale server
+ at home. There are only two users on the system. And I do no
+ mail-forwarding. So the log samples I have to work with are
+ commensurately limited.
+
+ If there's something that pflogsumm is not doing, or not doing right,
+ let me know what it is, what you think it ought to do, and send me a
+ representative sample of *real* log entries with which to work.
+
+ See Also: 9. pflogsumm just doesn't work or doesn't report anything
+ 12. pflogsumm's numbers don't add up
+ 17. pflogsumm doesn't understand my log file format
+ 20. Sending Logfile Samples
+
+
+9. pflogsumm just doesn't work or doesn't report anything
+
+ Did you *download* pflogsumm as opposed to grabbing it by
+ "copy-and-paste" from a browser? Copy-and-paste can result in lines
+ being unintentionally wrapped and hard-tabs being converted to
+ spaces. This will break pflogsumm.
+
+ Also, I've received a couple of reports by people downloading
+ pflogsumm with Lynx that the download has long lines wrapped.
+ Naturally, this breaks pflogsumm.
+
+ See Also: 8. pflogsumm misses/mis-diagnoses/mis-reports, etc.
+ <whatever>
+ 17. pflogsumm doesn't understand my log file format
+
+
+10. Postfix Rejects pflogsumm Reports Because Of Body Checks
+
+ You configure Postfix to do body checks, Postfix does its thing,
+ pflogsumm reports it and Postfix catches the same string in the
+ pflogsumm report. There are several solutions to this.
+
+ Wolfgang Zeikat contributed this:
+
+ #!/usr/bin/perl
+ use MIME::Lite;
+
+ ### Create a new message:
+ $msg = MIME::Lite->new(
+ From => 'your@send.er',
+ To => 'your@recipie.nt',
+ # Cc => 'some@other.com, some@more.com',
+ Subject => 'pflogsumm',
+ Date => `date`,
+ Type => 'text/plain',
+ Encoding => 'base64',
+ Path =>'/tmp/pflogg',
+ );
+
+ $msg->send;
+
+ Where "/tmp/pflogg" is the output of pflogsumm. This puts pflogsumm's
+ output in a base64 MIME attachment.
+
+ In a follow-up to a thread in the postfix-users mailing list, Ralf
+ Hildebrandt noted:
+
+ "mpack does the same thing."
+
+ The canonical FTP site for mpack is ftp.andrew.cmu.edu:pub/mpack/
+
+ The solution I came up with is to modify the body_checks statements to
+ ignore the strings when they're in a pflogsumm report, as follows:
+
+ Bounce anything with 6 or more "$"s in a row...
+
+ /\${6,}/ REJECT
+
+ Which, of course, catches the line in the pflogsumm report too.
+ So...
+
+ /^(?!\s+[0-9]+\s+).*?\${6,}/ REJECT
+
+ which reads "anything with 6 or more '$'s in a row that is not a line
+ beginning with one or more whitespace characters, followed by one or
+ more digits, followed by one or more whitespace characters."
+
+ (This is using PCRE's, btw.)
+
+ Note that my solution will be more computationally expensive, by a
+ *long* way, than encoding pflogsumm's output into a format that
+ body_checks won't catch.
+
+ Robert L Mathews suggested the following solution
+
+ /^ {6,11}[[:digit:]]{1,6}[ km] / OK
+
+ Placed at the beginning of a body_checks file, this will "pre-approve"
+ lines in pflogsumm's output that might otherwise get caught. That's
+ a POSIX regexp version. A PCRE version of the same thing would be:
+
+ /^ {6,11}\d{1,6}[ km] / OK
+
+
+11. pflogsumm Reports Double Traffic When Anti-Virus Scanner Used
+
+ Sadly, there's absolutely nothing I can do about this :-(.
+
+ The problem arises because of the way in which anti-virus scanning is
+ handled by Postfix. Basically, Postfix "delivers" each email to the
+ anti-virus scanner and the anti-virus scanner re-sends it through
+ Postfix. So each email really is received twice and sent/delivered
+ twice.
+
+ And yes, I tried. I really, really tried. If I recall correctly, I
+ spent some two days mucking-about with this problem. Actually thought
+ I had it once or twice. But the results inevitably failed regression
+ testing. At the end of this, and with some more careful thought, I
+ realized it just wasn't possible. If you think you can prove me
+ wrong, please do so. I'd be quite pleased to be proven wrong on this
+ one.
+
+ Note: As of 2026-08-16 I'm not certain the FAQ entry is still true.
+
+
+12. pflogsumm's numbers don't add up
+
+ pflogsumm reports more "delivered" than "received"
+
+ Naturally. A single email message can have multiple recipients.
+
+ pflogsumm reports more "rejected" than "received"
+
+ Why doesn't delivered + deferred + bounce + rejected = received?
+
+ Some rejects (header and body checks, for example) happen in
+ "cleanup," after alias lists are expanded. Thus a single received
+ message will be rejected multiple times: once for each recipient.
+
+ The "size=" fields, multiplied by their "nrcpt=" fields, when added-up
+ yields a total higher than pflogsumm's "bytes delivered" total.
+
+ pflogsumm doesn't count something delivered until it actually *is*
+ delivered. Nrcpt only suggests the number of intended recipients,
+ not how many are actually deliverable. Only if there were no
+ bounces, rejects, defers or other undeliverables for everything
+ that was received would a calculation such as that above yield the
+ proper value.
+
+ pflogsumm's "% rejected" doesn't add up
+
+ The "percent rejected" and "percent discarded" figures are only
+ approximations. They are calculated as follows (example is for
+ "percent rejected"):
+
+ percent rejected =
+
+ (rejected / (delivered + rejected + discarded)) * 100
+
+ Given the issues discussed above, this is really the best that can
+ be hoped-for, IMO.
+
+ I consistently see more "delivered" than "received." How is that
+ possible?
+
+ Any message that's got multiple recipients in the "To:,"
+ "Cc:," and "Bcc:" fields will result in a single "received"
+ with multiple "delivered"s, as well as, possibly, multiple
+ "rejects" (or reject warnings, discards or holds), depending
+ on where in Postfix' processing the rule was that resulted
+ in the reject, etc.
+
+ See Also: 8. pflogsumm misses/mis-diagnoses/mis-reports, etc.
+ <whatever>
+
+
+13. Hourly stats for reports run without "-d" option are halved
+
+ Scenario: On day #1 of a fresh logfile, you run pflogsumm with "-d
+ today" and the next day you run it with no "-d" option. The "Per-Hour
+ Traffic" statistics are approximately halved. How can this be?
+
+ Note that when you run pflogsumm on a logfile that contains multi-day
+ logfile entries, pflogsumm automatically changes the per-hour stats to
+ daily traffic averages. If there's even *one* logfile entry from
+ another day, all of the per-hour stats will be divided by two. Unless
+ you rotate logfiles *precisely* at midnight--and it's unlikely you can
+ guarantee that happening--there's no way to prevent this.
+
+
+14. How Do I Get pflogsumm To Email Reports To Me Daily/Weekly/etc.?
+
+ Excuse me? You're running a mailserver and you don't know how to use
+ cron to run things on a scheduled basis and pipe the output to
+ something that'll email it to you?
+
+ Oh. My. Lord.
+
+ *sigh*
+
+ Here's my crontab entries:
+
+ 10 0 * * * /usr/local/sbin/pflogsumm -d yesterday /var/log/syslog \
+ 2>&1 |/usr/bin/mailx -s "`uname -n` daily mail stats" postmaster
+
+ 10 4 * * 0 /usr/local/sbin/pflogsumm /var/log/syslog.0 \
+ 2>&1 |/usr/bin/mailx -s "`uname -n` weekly mail stats" postmaster
+
+ (Those are actually each a single line. I line-broke them [and
+ signified that with the "\"s] for readability.)
+
+ The first generates stats for the previous day and is run *after*
+ midnight. The second is run against the previous week's entire log.
+ (I rotate my logs weekly.)
+
+ If you rotate your logs on a different schedule, want monthly reports,
+ etc., I leave it as an exercise to you, the reader, to figure out how
+ to concatenate several logs to stdout and feed that to pflogsumm.
+
+ See Also: 3. Built-In Support for Compressed Logs
+ 4. Processing Multiple Log Files
+ The Unix manual pages for "cron," "crontab," "cat,"
+ "zcat," "gzip," "gunzip," "mail," "mailx," etc.
+
+
+15. How Can I View pflogsumm's Reports In My Web Browser?
+
+ Just direct pflogsumm's output to a file, call it "something.txt" or
+ whatever, and look at it with your browser :). If you want to get
+ fancy, create a post-processing shell script that'll create a
+ date-tagged file, like "mailstats-20030216.txt". It's easy.
+
+
+16. How can I best format my custom reject messages for display in
+ pflogsumm's output?
+
+ Reject reason strings found in the mail log will be truncated at the
+ first comma (","), colon (":") or semi-colon (";"). If you want a
+ "clause" in your reject message to appear in pflogsumm's output,
+ without having to specify --verbose-msg-detail, use a punctuation mark
+ other than one of those three, such as a dash ("-").
+
+
+17. pflogsumm doesn't understand my log file format
+
+ I've received several requests to modify pflogsumm's log file format
+ regular expression matching to accommodate "non-standard" log file
+ formats. I'm not inclined to honour such requests. The regexp that
+ identifies Postfix' log file entries is nearly incomprehensible as it
+ is. If your log file format has extra fields (e.g.: FreeBSD syslogd
+ with "-v -v" specified), or, as in one case (metalog), is lacking
+ fields, and you insist on doing things that way, I recommend you
+ code-up a little pre-filter to mung the format into a standard one.
+
+ See Also: 8. pflogsumm misses/mis-diagnoses/mis-reports, etc.
+ <whatever>
+ 9. pflogsumm just doesn't work or doesn't report anything
+
+
+18. Why Isn't There Any Mention Of "Monkey Butler" In The FAQ?
+
+ An on-line acquaintance asked if I'd put the phrase "monkey butler"
+ in the FAQ. The answer is no. pflogsumm is used by some rather
+ large corporations. There are credibility issues. Sorry. :)
+
+
+19. Translating pflogsumm (Support for Internationalization)
+
+ Unfortunately, pflogsumm doesn't currently have i18n support.
+
+ Prospective translators are urged to translate *only* the stable
+ Production versions. Beta and Alpha versions can sometimes change
+ rapidly.
+
+ If you do translate pflogsumm, let me know and I'll put a link to it
+ on pflogsumm's main web page.
+
+
+20. Sending Logfile Samples
+
+ Here's the deal with whatever you may send me in the way of log
+ samples:
+
+ . Obfuscate them if you want. But take care not to alter them
+ in such a manner that they're not accurate wrt the "realism" of
+ the data, make sure the field formatting is not altered, and
+ that the order of the log entries is not altered.
+
+ . The world is an unsafe place for your data, no matter where
+ it might reside. But I'll do my level best to ensure that your
+ data does not fall into the hands of others.
+
+ . If you want, I'll PGP-encrypt the data when it's not in
+ use.
+
+ . You can PGP-encrypt it when you send it to me if you're
+ concerned. My PGP public key can be found on my Web site and at
+ the PGP public key servers.
+
+ . If you want, I'll delete the sample data when the work is
+ done. But I would *like* to keep it around for future
+ regression-testing. It's your call. Let me know.
+
+
+21. From Where Can I Obtain pflogsumm?
+
+ https://athena.LinxNet.com/postfix_contrib.html
+
+
+Created: 15 Feb., 1999 / Last updated: 15 Aug., 2026
+
--- /dev/null
+
+pflogsumm INSTALL
+
+There's not much to installing pflogsumm, so it's all manual.
+
+ 1. Unpack the distribution (if you're reading this, you've already
+ gotten that far)
+
+ 2. Copy or move pflogsumm to some directory from which you'll
+ want to execute it. Watch the ownerships and permissions.
+ Make sure it's executable.
+
+ E.g.:
+
+ cp pflogsumm /usr/local/bin/pflogsumm
+ chown bin:bin /usr/local/bin/pflogsumm
+ chmod 755 /usr/local/bin/pflogsumm
+
+ 3. If there's a manual page available (pflogsumm.1), copy that to
+ wherever you stash local manpages. Make sure it's world-readable.
+
+ E.g. (on my Mint Linux system):
+
+ cp pflogsumm.1 /usr/local/share/man/man1/pflogsumm.1
+ chown bin:bin /usr/local/share/man/man1/pflogsumm.1
+ chmod 644 /usr/local/share/man/man1/pflogsumm.1
+
+ 4. Read the man page (or the top of pflogsumm itself) for usage.
+
+ 4a. Repeat steps 2-4 for pffrombyto and pftobyfrom, as well, if
+ you like.
+
+ 5. Check the FAQ
+
+ 6. Configure your cron jobs if you're going to run pflogsumm on an
+ automatic, scheduled basis. There are tips in the manpage and
+ the FAQ.
+
+That's about it.
+
USA.
An on-line copy of the GNU General Public License can be found
- http://www.fsf.org/copyleft/gpl.html.
+ at https://www.fsf.org/copyleft/gpl.html.
+++ /dev/null
-
-Pflogsumm README
-
-There's not much to installing pflogsumm, so it's all manual.
-
- 1. Unpack the distribution (if you're reading this, you've already
- gotten that far)
-
- 2. Copy or move pflogsumm to some directory from which you'll
- want to execute it. Maybe rename it to just "pflogsumm."
- Watch the ownerships and permissions. Make sure it's executable.
-
- E.g.:
-
- cp pflogsumm /usr/local/bin/pflogsumm
- chown bin:bin /usr/local/bin/pflogsumm
- chmod 755 /usr/local/bin/pflogsumm
-
- 3. If there's a manual page available (pflogsumm.1), copy that to
- /usr/local/man/man1 or wherever you stash local manpages. Make
- sure it's world-readable.
-
- E.g.:
-
- cp pflogsumm.1 /usr/local/man/man1/pflogsumm.1
- chown bin:bin /usr/local/man/man1/pflogsumm.1
- chmod 644 /usr/local/man/man1/pflogsumm.1
-
- 4. Read the man page (or the top of pflogsumm itself) for usage.
-
- 5. Check the FAQ (pflogsumm-faq.txt)
-
- 6. Configure your cron jobs if you're going to run pflogsumm on an
- automatic, scheduled basis. There are tips in the manpage and
- the FAQ.
-
-That's about it.
-
-As the manpage and FAQ both note: pflogsumm requires the Date::Calc
-Perl module if you want to use --smtpd_stats.
-
--- /dev/null
+
+# pflogsumm
+
+## Summarize Postfix MTA Log File Entries
+
+pflogsumm is a Perl script designed to provide an overview of Postfix MTA
+activity, meant to provide just enough detail to give the administrator a
+"heads up" for potential trouble spots.
+
+## Features
+
+The following is a summary of the reports produced:
+
+- Total number of:
+ - Messages received, delivered, forwarded, deferred, bounced, rejected,
+ etc.
+ - Bytes in messages received and delivered
+ - Sending and Recipient Hosts/Domains
+ - Senders and Recipients
+ - Optional SMTPD totals for number of connections, number of
+ hosts/domains connecting, average connect time and total connect time
+- Per-Day Traffic Summary (for multi-day logs)
+- Per-Hour Traffic (daily average for multi-day logs)
+- Optional Per-Hour and Per-Day SMTPD and Postscreen connection summaries
+- Sorted in descending order:
+ - Recipient Hosts/Domains by message count, including:
+ - Number of messages sent to recipient host/domain
+ - Number of bytes in messages
+ - Number of defers
+ - Average delivery delay
+ - Maximum delivery delay
+ - Sending Hosts/Domains by message and byte count
+ - Optional Hosts/Domains SMTPD connection summary
+ - Senders by message count
+ - Recipients by message count
+ - Senders by message size
+ - Recipients by message size
+ with an option to limit these reports to the top N.
+- A Semi-Detailed Summary of:
+ - Messages deferred
+ - Messages bounced
+ - Messages rejected
+- Optional summary and details of postscreen activity
+- Summaries of warnings, fatal errors, and panics
+- Summary of master daemon messages
+- Optional detail of messages received, sorted by domain, then
+ sender-in-domain, with a list of recipients-per-message.
+- Optional output of "mailq" run
+
+pflogsumm has extensive configuration options to allow you to tailor its
+reports to suit.
+
+## Requirements
+
+- Perl 5.10 or later
+- Date::Calc (Debian/Ubuntu: libdate-calc-perl, RHEL/Fedora: perl-Date-Calc)
+- Config::Simple (Debian/Ubuntu: libconfig-simple-perl, RHEL/Fedora:
+ perl-Config-Simple)
+ (If you wish to use the optional configuration file support)
+
+## License
+
+pflogsumm is licensed under the GNU General Public License, Version 2 or later.
+See the LICENSE file for details.
+
--- /dev/null
+
+To Be Done (Maybe)
+
+ Add option to display "SASL LOGIN authentication failed: (reason ...),
+ sasl_username=..." detail.
+
+ Look into:
+
+ Handling of "removed (canceled)" entries. E.g.:
+
+ Jul 21 13:14:00 myserver postfix/cleanup[1934251]: ABBE1120157:
+ removed (canceled)
+
+ This means that the SMTP client sent MAIL FROM and at least
+ one RCPT TO, but did not deliver an email message.
+
+ (Done)
+
+ %warnings
+ %inboundSSLerrs
+ --smtpd-warning-detail
+ replace with
+ --warning-detail (%warnings)
+ --smtpd-detail (%inboundSSLerrs, others?)
+ --host-cnt
+
+ interaction/use.
+
+ (Done)
+
+ Fix parsing for "451 4.3.5 Server configuration error;"
+
+ date ranges, "lastweek", etc. (Done)
+
+ (options for?) break-down by local vs. non-local?, further
+ "drill-downs" to sender/recipient domains?
+
+ Separate reports by-domain? (Would require that pflogsumm write files
+ instead of emitting to stdout? Or maybe that would be an option?)
+ Separate options for sender domain and receiver domain? Or perhaps
+ sender address and receiver address regex "filtering" options?
+
+ lower-case domains (Done)
+
+ don't k-ize msg counts? (Or do so at a higher boundary?) (Done)
+
+ implement proper version numbering (interim version numbering in
+ place) (use SCCS or RCS?) (Done)
+
+ add changelog (Done)
+
+ Expand docs (in code?)
+
+ Re-do docs to POD format? (Done)
+
+ Improve UUCP-style bang-path handling
+
+ Add option to use disk-based hash files instead of in-memory so
+ processing logfiles with lots of postfix log entries doesn't run
+ the machine out of memory? (This would really whack performance!)
+ (Maybe only needed with "-e" option.)
+
+ Add another "step" to integer processing: "g"? (Display formatting
+ will presently mess up at values exceeding 999999m.)
+
+ Internationalization? Necessary? There's English-language month
+ abbreviations hard-coded in pflogsumm. I'm admittedly real weak
+ in this area. (Covered by ISO 8601 option [below]?)
+
+ Add option to lower-case entire addresses, rather than only the
+ domains. (Or make that the default, and add an option to make
+ it just domains?) (The RFCs say username parts shouldn't be
+ touched!) (Done)
+
+ Add percentage-of-total to all (?) reports?
+
+ Add ability to handle compressed files within pflogsumm?
+ (Unlikely)
+
+ SMTP logging by host (msgs, connects) (add to new "by-domain"
+ reports?) (Done)
+
+ UUCP logging of some sort? (At least what is sent to what
+ host/gateway. Since rmail receives incoming, don't know as I
+ can do anything there.)
+
+ Option for ISO 8601 standard date & time formats. (Done)
+
+ Option for specifying "host" (for multi-host logfiles)?
+
+ Add POSIX regexp body_checks "bypass" docs to FAQ. (Liviu Daia,
+ Noel Jones)
+
+ Add "helper" program to distribution based on Wolfgang Zeikat's
+ MIME::Lite suggestion for the body_checks issue? (Will want to
+ make it read from stdin, securely create tempfile and clean up
+ afterward.)
+
+ Expand on SAV reporting? (Len Conrad)
+
+ Add "reject details" on "too many errors after <SMTP command>" log
+ lines? (Len Conrad)
+
+++ /dev/null
-
-To Be Done (Maybe)
-
- Look into:
-
- %warnings
- %inboundSSLerrs
- --smtpd-warning-detail
- replace with
- --warning-detail (%warnings)
- --smtpd-detail (%inboundSSLerrs, others?)
- --host-cnt
-
- interaction/use.
-
- (Done)
-
- Fix parsing for "451 4.3.5 Server configuration error;"
-
- date ranges, "lastweek", etc. (Done)
-
- (options for?) break-down by local vs. non-local?, further
- "drill-downs" to sender/recipient domains?
-
- Separate reports by-domain? (Would require that pflogsumm write files
- instead of emitting to stdout? Or maybe that would be an option?)
- Separate options for sender domain and receiver domain? Or perhaps
- sender address and receiver address regex "filtering" options?
-
- lower-case domains (Done)
-
- don't k-ize msg counts? (Or do so at a higher boundary?) (Done)
-
- implement proper version numbering (interim version numbering in
- place) (use SCCS or RCS?) (Done)
-
- add changelog (Done)
-
- Expand docs (in code?)
-
- Re-do docs to POD format? (Done)
-
- Improve UUCP-style bang-path handling
-
- Add option to use disk-based hash files instead of in-memory so
- processing logfiles with lots of postfix log entries doesn't run
- the machine out of memory? (This would really whack performance!)
- (Maybe only needed with "-e" option.)
-
- Add another "step" to integer processing: "g"? (Display formatting
- will presently mess up at values exceeding 999999m.)
-
- Internationalization? Necessary? There's English-language month
- abbreviations hard-coded in pflogsumm. I'm admittedly real weak
- in this area. (Covered by ISO 8601 option [below]?)
-
- Add option to lower-case entire addresses, rather than only the
- domains. (Or make that the default, and add an option to make
- it just domains?) (The RFCs say username parts shouldn't be
- touched!) (Done)
-
- Add percentage-of-total to all (?) reports?
-
- Add ability to handle compressed files within pflogsumm?
- (Unlikely)
-
- SMTP logging by host (msgs, connects) (add to new "by-domain"
- reports?) (Done)
-
- UUCP logging of some sort? (At least what is sent to what
- host/gateway. Since rmail receives incoming, don't know as I
- can do anything there.)
-
- Option for ISO 8601 standard date & time formats. (Done)
-
- Option for specifying "host" (for multi-host logfiles)?
-
- Add POSIX regexp body_checks "bypass" docs to FAQ. (Liviu Daia,
- Noel Jones)
-
- Add "helper" program to distribution based on Wolfgang Zeikat's
- MIME::Lite suggestion for the body_checks issue? (Will want to
- make it read from stdin, securely create tempfile and clean up
- afterward.)
-
- Expand on SAV reporting? (Len Conrad)
-
- Add "reject details" on "too many errors after <SMTP command>" log
- lines? (Len Conrad)
-
pffrombyto - List "from" addresses by "to" whom in Postfix log file
-Copyright (C) 2007-2025 by James S. Seymour, Release 1.2
+Copyright (C) 2007-2025 by James S. Seymour, Release $Revision: 1.2 $
=head1 SYNOPSIS
pffrombyto -[bchrRv] <recipient> [mailfile]
-R Hard rejects only (4xx rejects ignored)
-v Emit version and exit";
-my $revision = '1.2';
+my $revision = '$Revision: 1.2 $';
use vars qw($opt_b $opt_c $opt_h $opt_r $opt_R $opt_v);
.\" ========================================================================
.\"
.IX Title "PFFROMBYTO 1"
-.TH PFFROMBYTO 1 2025-05-22 1.2.1 "User Contributed Perl Documentation"
+.TH PFFROMBYTO 1 2026-09-15 1.3.0 "User Contributed Perl Documentation"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.SH NAME
pffrombyto \- List "from" addresses by "to" whom in Postfix log file
.PP
-Copyright (C) 2007\-2025 by James S. Seymour, Release 1.2
+Copyright (C) 2007\-2025 by James S. Seymour, Release $Revision: 1.2 $
.SH "SYNOPSIS pffrombyto \-[bchrRv] <recipient> [mailfile]"
.IX Header "SYNOPSIS pffrombyto -[bchrRv] <recipient> [mailfile]"
.Vb 1
pflogsumm - Produce Postfix MTA logfile summary
-Copyright (C) 1998-2026 by James S. Seymour, Release 1.2.1
+Copyright (C) 1998-2026 by James S. Seymour, Release 1.3.0
=head1 SYNOPSIS
pflogsumm [--config <file>] [--bounce-detail <cnt>] [--colwidth <n>]
[--problems-first] [--pscrn-detail <cnt>] [--pscrn-stats]
[-q|--quiet] [--rej-add-from] [--rej-add-to] [--reject-detail <cnt>]
[--smtpd-stats] [--srs-mung] [--ssl-tls-stats] [--syslog-name <string>]
- [-u|--user-cnt <cnt>] [--unprocd-file <filename>] [--use-orig-to]
- [--verbose-msg-detail] [--verp-mung [n]] [--warning-detail <cnt>]
- [-x|--debug <file>] [--zero-fill] [file1 [filen]]
+ [--suppress <reports>|help] [-u|--user-cnt <cnt>]
+ [--unprocd-file <filename>] [--use-orig-to] [--verbose-msg-detail]
+ [--verp-mung [n]] [--warning-detail <cnt>] [-x|--debug <file>]
+ [--zero-fill] [file1 [filen]]
pflogsumm --[dump-config|help|version]
See the discussion about the use of this option under
"NOTES," below.
+ --suppress <reports>
+
+ Specify a space-separated list of one-or-more reports
+ to suppress in the output.
+
+ Use "--suppress help" to get a list of valid report
+ section names.
+
--ssl-tls-stats
Report SMTP TLS statistics and SMTPD SSL/TLS errors.
my $haveConfigSimple = $@ ? 0 : 1;
my $mailqCmd = "mailq";
-my $release = "1.2.1";
+my $release = "1.3.0";
# Used for regression testing, so new features can be selectively
# disabled.
%connTime, %smtpdPerDay, %smtpdPerDom, $smtpdConnCnt, $smtpdTotTime,
%inboundSSLerrs,
%pscrnConnTime, %pscrnPerDay, %pscrnPerIP, $pscrnConnCnt, $pscrnTotTime,
- %smtpExcptnMsgs, $sizeDataExists, @deprecated
+ %smtpExcptnMsgs, $sizeDataExists, @deprecated, $msgsRmvdCncld
);
$dayCnt = $smtpdConnCnt = $smtpdTotTime = 0;
[--problems-first] [--pscrn-detail <cnt>] [--pscrn-stats]
[-q|--quiet] [--rej-add-from] [--rej-add-to] [--reject-detail <cnt>]
[--smtpd-stats] [--srs-mung] [--ssl-tls-stats] [--syslog-name <string>]
- [-u|--user-cnt <cnt>] [--unprocd-file <filename>] [--use-orig-to]
- [--verbose-msg-detail] [--verp-mung [n]] [--warning-detail <cnt>]
- [-x|--debug <file>] [--zero-fill] [file1 [filen]]
+ [--suppress <reports>|help] [-u|--user-cnt <cnt>]
+ [--unprocd-file <filename>] [--use-orig-to] [--verbose-msg-detail]
+ [--verp-mung [n]] [--warning-detail <cnt>] [-x|--debug <file>]
+ [--zero-fill] [file1 [filen]]
$progName --[dump-config|help|version]";
'smtpd-warning-detail' => { type => 'i' },
'srs-mung' => { type => 'b' },
'syslog-name' => { type => 's' },
+ 'suppress' => { type => 's' },
'ssl-tls-stats' => { type => 'b' },
'unprocd-file' => { type => 's' },
'use-orig-to' => { type => 'b' },
# Storage for actual values
our %opts;
+# Suppressible reports
+my %suppressed = (
+ 'host/domain' => 0,
+ 'per-hour' => 0,
+ 'rdns-warnings' => 0,
+ 'size-detail' => 0,
+);
+
# Dynamically build GetOptions argument list
my @getopt_args;
for my $long (sort keys %optionSpec) {
}
}
+# Process reports to suppress?
+if($opts{'suppress'}) {
+ foreach my $report (split ' ', $opts{'suppress'}) {
+ if($report eq 'help') {
+ print "Valid --suppress options:\n";
+ print " $_\n" foreach (sort keys %suppressed);
+ exit 0;
+ } elsif(! exists $suppressed{$report}) {
+ print STDERR "$progName: Invalid --suppress option \"$report\" — valid options are:\n";
+ print STDERR " $_\n" foreach (sort keys %suppressed);
+ exit 1;
+ }
+ $suppressed{$report} = 1;
+ }
+}
+
my $syslogName = $opts{'syslog-name'}? $opts{'syslog-name'} : "postfix";
if(defined($opts{'help'})) {
}
if($wpfClass eq 'warning') {
- $wpfPayload = string_trimmer($wpfPayload, 66);
- ++$warnings{$svc}{$wpfPayload};
+ unless($wpfPayload =~ /does not resolve to address/ && $suppressed{'rdns-warnings'}) {
+ $wpfPayload = string_trimmer($wpfPayload, 66);
+ ++$warnings{$svc}{$wpfPayload};
+ }
} elsif($wpfClass eq 'panic') {
++$panics{$svc}{$wpfPayload};
} elsif($wpfClass eq 'fatal') {
}
}
# header and body checks rejects happen in "cleanup"
- elsif($svc eq "cleanup" && (my($rejSubTyp, $rejReas, $rejRmdr) = $logRmdr =~
- /^((?:milter-)?reject|hold|discard): (header|body|END-OF-MESSAGE) (.*)$/) == 3)
- {
- $rejRmdr =~ s/( from \S+?)?; from=<.*$// unless($opts{'verbose-msg-detail'});
- # FIXME: In retrospect: I've no idea where I came up with the magic numbers I pass to this function.
- $rejRmdr = string_trimmer($rejRmdr, 64);
- if($rejSubTyp eq "reject" or $rejSubTyp eq "milter-reject") {
- ++$rejects{$svc}{$rejReas}{$rejRmdr} unless($opts{'reject-detail'} == 0);
- ++$msgsRjctd;
- if($opts{'debug'}) {
- push(@{$qidTracker{$qid}{'status'}}, "\$svc: $svc, \$rejSubTyp: $rejSubTyp, --\$msgsRcvd");
- ++$qidTracker{$qid}{'lateRejects'};
- dbg("dbg: late reject \$rcvdMsg{$qid}{'size'}: $rcvdMsg{$qid}{'size'}\n") if $rcvdMsg{$qid}{'size'};
+ elsif($svc eq "cleanup") {
+ if((my($rejSubTyp, $rejReas, $rejRmdr) = $logRmdr =~
+ /^((?:milter-)?reject|hold|discard): (header|body|END-OF-MESSAGE) (.*)$/) == 3)
+ {
+ $rejRmdr =~ s/( from \S+?)?; from=<.*$// unless($opts{'verbose-msg-detail'});
+ # FIXME: In retrospect: I've no idea where I came up with the magic numbers I pass to this function.
+ $rejRmdr = string_trimmer($rejRmdr, 64);
+ if($rejSubTyp eq "reject" or $rejSubTyp eq "milter-reject") {
+ ++$rejects{$svc}{$rejReas}{$rejRmdr} unless($opts{'reject-detail'} == 0);
+ ++$msgsRjctd;
+ if($opts{'debug'}) {
+ push(@{$qidTracker{$qid}{'status'}}, "\$svc: $svc, \$rejSubTyp: $rejSubTyp, --\$msgsRcvd");
+ ++$qidTracker{$qid}{'lateRejects'};
+ dbg("dbg: late reject \$rcvdMsg{$qid}{'size'}: $rcvdMsg{$qid}{'size'}\n") if $rcvdMsg{$qid}{'size'};
+ }
+ --$msgsRcvd; # Late Reject: It will have already been counted as "Received," even though it ultimately is not
+ } elsif($rejSubTyp eq "hold") {
+ ++$holds{$svc}{$rejReas}{$rejRmdr} unless($opts{'reject-detail'} == 0);
+ ++$msgsHld;
+ } elsif($rejSubTyp eq "discard") {
+ push(@{$qidTracker{$qid}{'status'}}, "\$svc: $svc, \$rejSubTyp: $rejSubTyp") if $opts{'debug'};
+ ++$discards{$svc}{$rejReas}{$rejRmdr} unless($opts{'reject-detail'} == 0);
+ ++$msgsDscrdd;
}
- --$msgsRcvd; # Late Reject: It will have already been counted as "Received," even though it ultimately is not
- } elsif($rejSubTyp eq "hold") {
- ++$holds{$svc}{$rejReas}{$rejRmdr} unless($opts{'reject-detail'} == 0);
- ++$msgsHld;
- } elsif($rejSubTyp eq "discard") {
- push(@{$qidTracker{$qid}{'status'}}, "\$svc: $svc, \$rejSubTyp: $rejSubTyp") if $opts{'debug'};
- ++$discards{$svc}{$rejReas}{$rejRmdr} unless($opts{'reject-detail'} == 0);
- ++$msgsDscrdd;
+ delete($rcvdMsg{$qid}); # We're done with this
+ ++$rejPerHr[$msgHr];
+ ++${$msgsPerDay{$revMsgDateStr}}[4];
+ } elsif($logRmdr eq 'removed (canceled)') {
+ # Client quit/disco'd before anything was actually received
+ ++$msgsRmvdCncld;
+ --$msgsRcvd;
+ delete($rcvdMsg{$qid}) if($rcvdMsg{$qid});
+ ++$qidTracker{$qid}{'rmvdCncldCnt'}; # Debug code
+ push(@{$qidTracker{$qid}{'status'}}, "\$svc: $svc, status: removed (canceled), --\$msgsRcvd") if $opts{'debug'};
+ } else {
+ print $unProcd "[" . __FILE__ . ":" . __LINE__ . "]: $_\n" if $unProcd;
}
- delete($rcvdMsg{$qid}); # We're done with this
- ++$rejPerHr[$msgHr];
- ++${$msgsPerDay{$revMsgDateStr}}[4];
} elsif($svc eq 'master') {
++$masterMsgs{$logRmdr};
} elsif($svc eq 'smtpd' || $svc eq 'postscreen' || $svc eq 'pickup') {
++$multiRcvdCnt;
}
}
+ if(exists $qidTracker{$qid}{'rmvdCncldCnt'}) {
+ dbg(" removed (canceled): $qidTracker{$qid}{'rmvdCncldCnt'}\n");
+ }
$lateRejects += $qidTracker{$qid}{'lateRejects'} if $qidTracker{$qid}{'lateRejects'};
foreach my $event (@{$qidTracker{$qid}{'status'}}) {
dbg(" $event\n");
dbg(sprintf(" %6d%s qids w/no received count (%d%s delivered)\n", adj_int_units($noRcvdCnt), adj_int_units($noRcvdCntDlvrd)));
dbg(sprintf(" %6d%s forwarded\n", adj_int_units($msgsFwdd)));
dbg(sprintf(" %6d%s discarded\n", adj_int_units($msgsDscrdd)));
+ dbg(sprintf(" %6d%s qids removed (canceled)\n", adj_int_units($msgsRmvdCncld)));
dbg(sprintf(" %6d%s qids w/no size data\n", adj_int_units($noSizeCnt)));
dbg(sprintf(" %6d%s late rejects (rec'd but not dlvrd)\n", adj_int_units($lateRejects)));
}
printf " (%d%s deferrals)", adj_int_units($msgsDfrdCnt) if($msgsDfrdCnt);
print "\n";
printf " %6d%s bounced\n", adj_int_units($msgsBncd);
+printf " %6d%s removed (canceled)\n", adj_int_units($msgsRmvdCncld);
printf " %6d%s expired\n", adj_int_units($msgsExprd);
printf " %6d%s rejected (%d%%)\n", adj_int_units($msgsRjctd), $msgsRjctdPct;
printf " %6d%s reject warnings\n", adj_int_units($msgsWrnd);
print_problems_reports() if(defined($opts{'problems-first'}));
-print_per_day_summary(\%msgsPerDay) if($dayCnt > 1);
-print_per_hour_summary(\@rcvPerHr, \@dlvPerHr, \@dfrPerHr, \@bncPerHr,
- \@rejPerHr, $dayCnt);
+unless($suppressed{'per-hour'}) {
+ print_per_day_summary(\%msgsPerDay) if($dayCnt > 1);
+ print_per_hour_summary(\@rcvPerHr, \@dlvPerHr, \@dfrPerHr, \@bncPerHr,
+ \@rejPerHr, $dayCnt);
+}
-print_recip_domain_summary(\%recipDom, $opts{'host-cnt'});
-print_sending_domain_summary(\%sendgDom, $opts{'host-cnt'});
+print_recip_domain_summary(\%recipDom, $opts{'host-cnt'}) unless $suppressed{'host/domain'};
+print_sending_domain_summary(\%sendgDom, $opts{'host-cnt'}) unless $suppressed{'host/domain'};
if(defined($opts{'smtpd-stats'})) {
- print_per_day_smtpd(\%smtpdPerDay, $dayCnt) if($dayCnt > 1);
- print_per_hour_smtpd(\@smtpdPerHr, $dayCnt);
- print_domain_smtpd_summary(\%smtpdPerDom, $opts{'host-cnt'});
+ unless($suppressed{'per-hour'}) {
+ print_per_day_smtpd(\%smtpdPerDay, $dayCnt) if($dayCnt > 1);
+ print_per_hour_smtpd(\@smtpdPerHr, $dayCnt);
+ }
+ print_domain_smtpd_summary(\%smtpdPerDom, $opts{'host-cnt'}) unless $suppressed{'host/domain'};
}
if(defined($opts{'ssl-tls-stats'})) {
print_user_data(\%sendgUser, "Senders by message count", MSG_CNT_I, $opts{'user-cnt'}, $opts{'quiet'});
print_user_data(\%recipUser, "Recipients by message count", MSG_CNT_I, $opts{'user-cnt'}, $opts{'quiet'});
-print_user_data(\%sendgUser, "Senders by message size", MSG_SIZE_I, $opts{'user-cnt'}, $opts{'quiet'});
-print_user_data(\%recipUser, "Recipients by message size", MSG_SIZE_I, $opts{'user-cnt'}, $opts{'quiet'});
+print_user_data(\%sendgUser, "Senders by message size", MSG_SIZE_I, $opts{'user-cnt'}, $opts{'quiet'}) unless $suppressed{'size-detail'};
+print_user_data(\%recipUser, "Recipients by message size", MSG_SIZE_I, $opts{'user-cnt'}, $opts{'quiet'}) unless $suppressed{'size-detail'};
print_hash_by_key(\%noMsgSize, "Messages with no size data", 0, 1);
+++ /dev/null
-
-FAQ for Pflogsumm - A Log Summarizer/Analyzer for the Postfix MTA
-
-Introduction
-
- I wouldn't have believed it. What started out mostly as a light-
- hearted exercise in improving my facility with Perl--with the hope
- that something useful would come out of it as well--has turned out to
- be a somewhat popular utility. And as more Admins find out about
- postfix, and more end up trying pflogsumm, many of the questions,
- suggestions, and enhancement requests are becoming "frequently
- asked". So odd as it seems (to me, at any rate), it looks like it's
- time for a FAQ.
-
-
-Index of pflogsumm Frequently Asked Questions (in no particular order)
-
- 1. Project Status
- 2. "Could You Make" or "Here's A Patch To Make" Pflogsumm Do ...
- 3. Requires Date:Calc Module
- 4. Built-In Support for Compressed Logs
- 5. Processing Multiple Log Files
- 6. Time-Based Reporting and Statistics
- 7. By-domain Listings
- 8. Reject, Deferred and Bounced Detail Info
- 9. "Orphaned" (no size) Messages
- 10. Pflogsumm misses/mis-diagnoses/mis-reports, etc. <whatever>
- 11. Pflogsumm is generating lots of "uninitialized value" warnings
- 12. Pflogsumm just doesn't work or doesn't report anything
- 13. Postfix Rejects Pflogsumm Reports Because Of Body Checks
- 14. Pflogsumm Reports Double Traffic When Anti-Virus Scanner Used
- 15. Pflogsumm's numbers don't add up
- 16. Hourly stats for reports run without "-d" option are halved
- 17. How Do I Get Pflogsumm To Email Reports To Me Daily/Weekly/etc.?
- 18. How Can I View Pflogsumm's Reports In My Web Browser?
- 19. New Red Hat install - Pflogsumm no longer works!
- 20. How can I best format my custom reject messages for display in
- Pflogsumm's output?
- 21. Pflogsumm doesn't understand my log file format
- 22. Why Isn't There Any Mention Of "Monkey Butler" In The FAQ?
- 23. Translating Pflogsumm (Support for Internationalization)
- 24. Pflogsumm may sometimes calculate "yesterday" incorrectly
- 25. Sending Logfile Samples
- 26. From Where Can I Obtain Pflogsumm?
-
-
-1. Project Status
-
- New work on Pflogsumm is sporadic. It pretty much does everything I
- need it to do and, so far as I can tell, pretty much what most other
- people need it to do. And my time is limited.
-
- I'll still take bug reports. I'll still fix bugs. (But I promise no
- time-line.) I'll still answer questions (as time allows). And I
- *may* add the occasional enhancement or whatever--as the mood
- strikes--but Pflogsumm is pretty much a "finished work" as far as I'm
- concerned.
-
-
-2. "Could You Make" or "Here's A Patch To Make" Pflogsumm Do ...
-
- Unless it's a *bug* fix, please see: "1. Project Status"
-
- To the argument "But it's a patch, all you have to do is...," the
- answer is: "Not quite." Every time I make a change to Pflogsumm I
- have to run it through a series of regression checks to make sure the
- change didn't break something. Then there's the commit,
- documentation, web page update, etc. cycle.
-
- I'm particularly unlikely to add code to Pflogsumm to account for
- non-standard Postfix log entries. "Non-standard" being defined as
- "other than what Wietse's code does." Or additional stats gathering
- that nobody else has requested and strikes *me* as of limited interest
- or use. In addition to the development cycle, there's the issue of
- "code bloat." Pflogsumm already takes enough (too much?) time and
- memory on busy machines with large logs. I'm not prone to make this
- worse for the sake of these things.
-
- See Also: 21. Pflogsumm doesn't understand my log file format
-
-
-3. Requires Date::Calc Module
-
- Pflogsumm requires the Date::Calc module. You can download and
- install the Date::Calc module from CPAN. It can be found at:
-
- http://search.cpan.org/search?module=Date::Calc
-
- Or you can remove the code that's dependent on the Date::Calc module.
- For the convenience of folks that would prefer to take this approach,
- I've "fenced" all such code like this:
-
- # ---Begin: SMTPD_STATS_SUPPORT---
- .
- .
- .
- <bunch of code>
- .
- .
- .
- # ---End: SMTPD_STATS_SUPPORT---
-
- However, if you do this you will lose support for --smtpd-stats.
-
- Later versions of the Pflogsumm distribution include a script to
- semi-automate removing smtpd stats support, if you so-desire.
-
- As of Pflogsumm-1.1.1, the presence of Date::Calc is optional. If you
- don't want to use the Pflogsumm options that depend upon it, you
- neither need Date::Calc, nor is it necessary to manually remove the
- code that depends upon it.
-
-
-4. Built-In Support for Compressed Logs
-
- I took a look at this. There is a Perl module (which I downloaded,
- built, and installed here) to interface to libz, but after considering
- the changes that would be necessary--and the fact that those changes
- would require that potential users have to download/build/install libz
- (and of the correct version) and the additional Perl module, I decided
- to forego this enhancement.
-
- I could just open a pipe within Pflogsumm and use zcat/gunzip/gzip.
- That would depend upon a) them being there [probably a safe bet--
- considering the logs somehow got into that format :-), but...] and b)
- one of these either being in the path or having an environment
- variable or a script variable or...
-
- The thing is, in the latter case there's really no "savings" over
- simply piping into Pflogsumm in the first place. Multiple processes
- get spawned, pipes opened, etc. either way. It would add a little
- convenience, is all.
-
- So I could do it. And there are a couple of ways I could do it. And
- my mind is certainly still open on the issue. I'm just not convinced
- there's a good reason to do it, is all. And I'd like to avoid
- "creeping over-feature-itis" if I can. My position is *not* set in
- stone on this issue. In the mean-time:
-
- zcat /var/log/maillog.0.gz |pflogsumm <args...>
-
- or
-
- gunzip </var/log/maillog.0.gz |pflogsumm <args...>
-
- should do the trick quite nicely for you.
-
- If you've a complex situation, for example: your logs aren't rotated
- exactly at midnight, you might try something like:
-
- (zcat /var/log/maillog.0.gz; cat /var/log/maillog) \
- |pflogsumm -d yesterday
-
- See Also: 5. Processing Multiple Log Files
- 17. How Do I Get Pflogsumm To Email Reports To Me
- Daily/Weekly/etc.?
-
-
-5. Processing Multiple Log Files
-
- When processing multiple log files (say: an entire weeks worth of logs
- that are rotated daily), it is important that Pflogsumm be fed them in
- chronological order. For performance and memory conservation reasons,
- Pflogsumm relies on log messages "arriving" in the order in which they
- were created.
-
- If you do something like this:
-
- pflogsumm /var/log/maillog*
-
- you might not get what you expect! Instead, try something like:
-
- pflogsumm `ls -rt /var/log/maillog*`
-
- A more complex example, where compressed logs are involved:
-
- (zcat `ls -rt /var/log/maillog.*.gz`; cat /var/log/maillog) \
- |pflogsumm
-
- Obviously, this depends on the file modification times for your logs
- being reflective of their chronological order. If that can't be
- trusted, you're gonna have to get ugly. Like in enumerating each
- file, or as in:
-
- (for each in 3 2 1 0; do
- zcat "/var/log/maillog.$each.gz"
- done
- cat /var/log/maillog) |pflogsumm
-
- or (somewhat more efficiently--by running zcat only once):
-
- (zcat `for ea in 3 2 1 0; do echo "/var/log/maillog.$ea.gz";
- done`; cat /var/log/maillog) |pflogsumm
-
- [Note: I didn't actually run these. So you would be well-advised
- to double-check them.]
-
- See Also: 4. Built-In Support for Compressed Logs
- 17. How Do I Get Pflogsumm To Email Reports To Me
- Daily/Weekly/etc.?
-
-
-6. Time-Based Reporting and Statistics
-
- There has been a small assortment of requests for different time
- statistics reporting. And adding this would be relatively straight-
- forward. (Just have to reach a consensus on exactly *what* should be
- reported, and how. This could easily get out of hand!)
-
- There's only one *small* problem. Ironically, it's time.
-
- I've experimented with Pflogsumm grokking the log timestamps. As a
- matter-of-fact: the enhancement added in the 19990110-05 version
- required that I do some of this. My first pass was to use the Perl
- timelocal() function to convert those sub-strings to an integer for
- subsequent comparison operations. Imagine my surprise when
- performance of the resulting code was a factor of five (5) times
- slower than that of its predecessor. After a "remove the statements
- until it got fast again" exercise, I found that the culprit was
- timelocal().
-
- As of version 19990321-01, Pflogsumm does by-domain stats reporting of
- average and maximum delivery time by host/domain. And an even earlier
- version added by-hour and by-day message count reporting. Anything
- much beyond these is going to get "expensive."
-
- If/when any additional time-based stats reporting is added: I think
- they are definitely going to be optional.
-
- One way you can make up for Pflogsumm's deficiency in this respect is
- to use good ol' Unix tools like "grep" to pre-process your log files
- before feeding them to Pflogsumm. E.g.:
-
- grep "Feb 9" /var/log/maillog |pflogsumm what_ever_args
-
- Note that single-digit days-of-the-month have an additional leading
- space in the logfiles, where the digit for two-digit dates would be.
-
-
-7. By-domain Listings
-
- I figured on the desire for this one from the start. There are many
- possibilities:
-
- 1) A single report, split by domain
- 2) An option to limit reporting to a particular domain
-
- This issue is kind of tricky. The popularity of Unix amongst
- SysAdmins is testimony to the beauty of being able to wire- together
- small, simple tools so that one can generate output to ones taste.
- Anything I do is likely to make some Admins happy and others wishing
- I'd done it "the other way".
-
- One thought that occurred is to perhaps provide a couple of options
- that would allow one to limit a particular report to
-
- sender=regular_expression and/or recipient=regular_expression
-
- The problem with this solution is that an Admin desiring to emit
- custom reports for multiple domains would have to re-process the same
- log multiple times--once for each desired domain.
-
- So I'm still thinking about this one.
-
-
-8. Reject, Deferred and Bounced Detail Info
-
- I've actually only received one query about this so far, but there are
- bound to be more. So...
-
- The "detailed" information in the "Reject", "Deferred" and "Bounced"
- reports is a compromise. Just take a stroll through your postfix logs
- some day and observe the variation in how the "reason" for a
- particular reject, defer, or bounce is reported. Without putting a
- lot of static comparisons for each-and-every case into the analyzer, I
- have absolutely no hope is doing this very well.
-
- Emitting the entire "reason" is not good, either. The entire "reason"
- string can be very long. Depending on what somebody is using to
- display Pflogsumm's output, the lines may well wrap-- producing output
- that is no more readable than just grepping the logs.
-
- And anything more I do to this end may soon be rendered moot. After
- Wietse gets most of the more important functional stuff out of the
- way, Postfix logging is going to be completely re-written. (Oh boy,
- won't that be fun!) I'm hoping I'll be able to get some input into
- the process so the formatting is more amenable to automated
- processing. Wietse has indicated that such would be the case.
-
- Also, please note my primary objective behind Pflogsumm (besides the
- entertainment value): "just enough detail to give the administrator a
- ``heads up'' for potential trouble spots." It's not *supposed* to do
- away with manual inspection entirely.
-
- For those that really want all that extra detail in the log summary
- reports, specify the "--verbose-msg-detail" switch.
-
- See Also: 25. Sending Logfile Samples
-
-
-9. "Orphaned" (no size) Messages
-
- The Problem:
-
- Message size is reported only by the queue manager. The message
- may be delivered long-enough after the (last) qmgr log entry that
- the information is not in the log(s) processed by a particular run
- of pflogsumm.
-
- The Result:
-
- "Orphaned" messages. These are reported by Pflogsumm as "Messages
- with no size data."
-
- This, of course, throws off "Recipients by message size" and the
- total for "bytes delivered." ("bytes in messages" in earlier
- versions.)
-
- The Solution:
-
- "Memorize" message sizes by queue i.d. Easy in theory. Difficult
- in practice. At least at the moment.
-
- You see, if Pflogsumm's going to "memorize" message sizes, it has
- to have some definitive way to know when to delete a no-
- longer-needed reference. Otherwise the memory file will just grow
- forever.
-
- As with the "Reject, Deferred and Bounced Detail Info" issue above,
- I'm hoping the get some input into future changes in logging issues.
- In any event: maybe whatever comes out of the logging redesign will
- provide a solution.
-
- As of Pflogsumm version 1.0.12, the "Messages with no size data" report
- can be turned off.
-
-
-10. Pflogsumm misses/mis-diagnoses/mis-reports, etc. <whatever>
-
- Are you using a real old version of VMailer? As of pflogsumm
- version 19990220-06, versions of VMailer prior to 19981023 are no
- longer supported. Sorry. Pflogsumm-19990121-01.pl will be made
- permanently available from now on for those with out-of-date versions
- of VMailer prior to 19981023.
-
- Are you processing your log files in chronological order? See item
- "5: "Processing Multiple Log Files".
-
- Pflogsumm is being developed by me on my rather small-scale server
- at home. There are only two users on the system. And I do no
- mail-forwarding. So the log samples I have to work with are
- commensurately limited.
-
- If there's something that Pflogsumm is not doing, or not doing right,
- let me know what it is, what you think it ought to do, and send me a
- representative sample of *real* log entries with which to work.
-
- See Also: 5. Processing Multiple Log Files
- 12. Pflogsumm just doesn't work or doesn't report anything
- 15. Pflogsumm's numbers don't add up
- 19. New Red Hat install - Pflogsumm no longer works!
- 21. Pflogsumm doesn't understand my log file format
- 25. Sending Logfile Samples
-
-
-11. Pflogsumm is generating lots of "uninitialized value" warnings
-
- Are you using a version of Perl lower than 5.004_04? Perhaps with a
- "beta" version of pflogsumm? If so, try turning off the "-w"
- switch. Pflogsumm as of 19990413-02beta appeared to work correctly
- with Perl 5.003 in spite of the warnings. (Those warnings didn't
- appear with Perl 5.004.)
-
- I don't guarantee that I'll remember to test future versions of
- pflogsumm against 5.003, but I'll try to :-).
-
- You really should consider upgrading your Perl to 5.004 or later.
-
-
-12. Pflogsumm just doesn't work or doesn't report anything
-
- Did you *download* Pflogsumm as opposed to grabbing it by
- "copy-and-paste" from a browser? Copy-and-paste can result in lines
- being unintentionally wrapped and hard-tabs being converted to
- spaces. This will break Pflogsumm.
-
- Also, I've received a couple of reports by people downloading
- Pflogsumm with Lynx that the download has long lines wrapped.
- Naturally, this breaks Pflogsumm.
-
- See Also: 10. Pflogsumm misses/mis-diagnoses/mis-reports, etc.
- <whatever>
- 19. New Red Hat install - Pflogsumm no longer works!
- 21. Pflogsumm doesn't understand my log file format
-
-
-13. Postfix Rejects Pflogsumm Reports Because Of Body Checks
-
- You configure Postfix to do body checks, Postfix does its thing,
- Pflogsumm reports it and Postfix catches the the same string in the
- Pflogsumm report. There are several solutions to this.
-
- Wolfgang Zeikat contributed this:
-
- #!/usr/bin/perl
- use MIME::Lite;
-
- ### Create a new message:
- $msg = MIME::Lite->new(
- From => 'your@send.er',
- To => 'your@recipie.nt',
- # Cc => 'some@other.com, some@more.com',
- Subject => 'pflogsumm',
- Date => `date`,
- Type => 'text/plain',
- Encoding => 'base64',
- Path =>'/tmp/pflogg',
- );
-
- $msg->send;
-
- Where "/tmp/pflogg" is the output of Pflogsumm. This puts Pflogsumm's
- output in a base64 MIME attachment.
-
- In a follow-up to a thread in the postfix-users mailing list, Ralf
- Hildebrandt noted:
-
- "mpack does the same thing."
-
- The canonical FTP site for mpack is ftp.andrew.cmu.edu:pub/mpack/
-
- The solution I came up with is to modify the body_checks statements to
- ignore the strings when they're in a Pflogsumm report, as follows:
-
- Bounce anything with 6 or more "$"s in a row...
-
- /\${6,}/ REJECT
-
- Which, of course, catches the line in the Pflogsumm report too.
- So...
-
- /^(?!\s+[0-9]+\s+).*?\${6,}/ REJECT
-
- which reads "anything with 6 or more '$'s in a row that is not a line
- beginning with one or more whitespace characters, followed by one or
- more digits, followed by one or more whitespace characters."
-
- (This is using PCRE's, btw.)
-
- Note that my solution will be more computationally expensive, by a
- *long* way, than encoding Pflogsumm's output into a format that
- body_checks won't catch.
-
- Robert L Mathews suggested the following solution
-
- /^ {6,11}[[:digit:]]{1,6}[ km] / OK
-
- Placed at the beginning of a body_checks file, this will "pre-approve"
- lines in Pflogsumm's output that might otherwise get caught. That's
- a POSIX regexp version. A PCRE version of the same thing would be:
-
- /^ {6,11}\d{1,6}[ km] / OK
-
-
-14. Pflogsumm Reports Double Traffic When Anti-Virus Scanner Used
-
- Sadly, there's absolutely nothing I can do about this :-(.
-
- The problem arises because of the way in which anti-virus scanning is
- handled by Postfix. Basically, Postfix "delivers" each email to the
- anti-virus scanner and the anti-virus scanner re-sends it through
- Postfix. So each email really is received twice and sent/delivered
- twice.
-
- And yes, I tried. I really, really tried. If I recall correctly, I
- spent some two days mucking-about with this problem. Actually thought
- I had it once or twice. But the results inevitably failed regression
- testing. At the end of this, and with some more careful thought, I
- realized it just wasn't possible. If you think you can prove me
- wrong, please do so. I'd be quite pleased to be proven wrong on this
- one.
-
- johnfawcett at tiscali-dot-it believes he's done it. You may find
- prefiltering your log with his "prepflog" does it for you. You can
- find it at <http://web.tiscali.it/postfix/>.
-
- Note: Because of the way John's pre-processing script works,
- which, given my own experiments, is probably the way it *has*
- to work to work correctly, integrating his code into Pflogsumm
- would be difficult, at best, if it's even possible within
- Pflogsumm's current structure.
-
-
-15. Pflogsumm's numbers don't add up
-
- Pflogsumm reports more "delivered" than "received"
-
- Naturally. A single email message can have multiple recipients.
-
- Pflogsumm reports more "rejected" than "received"
-
- Why doesn't delivered + deferred + bounce + rejected = received?
-
- Some rejects (header and body checks, for example) happen in
- "cleanup," after alias lists are expanded. Thus a single received
- message will be rejected multiple times: once for each recipient.
-
- The "size=" fields, multiplied by their "nrcpt=" fields, when added-up
- yields a total higher than Pflogsumm's "bytes delivered" total.
-
- Pflogsumm doesn't count something delivered until it actually *is*
- delivered. Nrcpt only suggests the number of intended recipients,
- not how many are actually deliverable. Only if there were no
- bounces, rejects, defers or other undeliverables for everything
- that was received would a calculation such as that above yield the
- proper value.
-
- Pflogsumm's "% rejected" doesn't add up
-
- The "percent rejected" and "percent discarded" figures are only
- approximations. They are calculated as follows (example is for
- "percent rejected"):
-
- percent rejected =
-
- (rejected / (delivered + rejected + discarded)) * 100
-
- Given the issues discussed above, this is really the best that can
- be hoped-for, IMO.
-
- I consistently see more "delivered" than "received." How is that
- possible?
-
- Any message that's got multiple recipients in the "To:,"
- "Cc:," and "Bcc:" fields will result in a single "received"
- with multiple "delivered"s, as well as, possibly, multiple
- "rejects" (or reject warnings, discards or holds), depending
- on where in Postfix' processing the rule was that resulted
- in the reject, etc.
-
- See Also: 10. Pflogsumm misses/mis-diagnoses/mis-reports, etc.
- <whatever>
-
-
-16. Hourly stats for reports run without "-d" option are halved
-
- Scenario: On day #1 of a fresh logfile, you run Pflogsumm with "-d
- today" and the next day you run it with no "-d" option. The "Per-Hour
- Traffic" statistics are approximately halved. How can this be?
-
- Note that when you run Pflogsumm on a logfile that contains multi-day
- logfile entries, Pflogsumm automatically changes the per-hour stats to
- daily traffic averages. If there's even *one* logfile entry from
- another day, all of the per-hour stats will be divided by two. Unless
- you rotate logfiles *precisely* at midnight--and it's unlikely you can
- guarantee that happening--there's no way to prevent this.
-
-
-17. How Do I Get Pflogsumm To Email Reports To Me Daily/Weekly/etc.?
-
- Excuse me? You're running a mailserver and you don't know how to use
- cron to run things on a scheduled basis and pipe the output to
- something that'll email it to you?
-
- Oh. My. Lord.
-
- *sigh*
-
- Here's my crontab entries:
-
- 10 0 * * * /usr/local/sbin/pflogsumm -d yesterday /var/log/syslog \
- 2>&1 |/usr/bin/mailx -s "`uname -n` daily mail stats" postmaster
-
- 10 4 * * 0 /usr/local/sbin/pflogsumm /var/log/syslog.0 \
- 2>&1 |/usr/bin/mailx -s "`uname -n` weekly mail stats" postmaster
-
- (Those are actually each a single line. I line-broke them [and
- signified that with the "\"s] for readability.)
-
- The first generates stats for the previous day and is run *after*
- midnight. The second is run against the previous week's entire log.
- (I rotate my logs weekly.)
-
- If you rotate your logs on a different schedule, want monthly reports,
- etc., I leave it as an exercise to you, the reader, to figure out how
- to concatenate several logs to stdout and feed that to Pflogsumm.
-
- See Also: 4. Built-In Support for Compressed Logs
- 5. Processing Multiple Log Files
- The Unix manual pages for "cron," "crontab," "cat,"
- "zcat," "gzip," "gunzip," "mail," "mailx," etc.
-
-
-18. How Can I View Pflogsumm's Reports In My Web Browser?
-
- Just direct Pflogsumm's output to a file, call it "something.txt" or
- whatever, and look at it with your browser :). If you want to get
- fancy, create a post-processing shell script that'll create a
- date-tagged file, like "mailstats-20030216.txt". It's easy.
-
- See Also: Pflogsumm Through A Browser, on Pflogsumm's home page.
-
-
-19. New Red Hat install - Pflogsumm no longer works!
-
- From some email exchanges with a couple of people that reported
- this...
-
- "It appears the Pflogsumm is broken with RedHat9. I can take
- the same log file and run it under Solaris9/RedHat 7.3 (perl 5.8
- on both) without a problem, but it breaks on RH9."
-
- "Oops. Sorry about the false alarm. This is an issue with
- some of the other Perl scripts that are out there due to Red Hat
- 8/9 using LANG=en_US.UTF-8
-
- Changing the locale to "POSIX" fixes this...
- LANG=C
-
- Note that Pflogsumm works fine when run through cron.daily, as
- cron has different environment settings."
-
- "Ah, the good old RH8/9 UTF-8 strikes again. I should have
- known. Setting LANG to either en_US or C fixes the problem."
-
- What the above means is that you have to change the "LANG" environment
- variable from "en_US.UTF-8" to "en_US" or "C". E.g.:
-
- LANG="en_US"
- export LANG
-
- in your shell. Or you could add these commands to your login
- profile. (I.e.: $HOME/.bash_profile, if you're using bash.) Or set
- the system-wide default in /etc/sysconfig/i18n. My RH boxes have LANG
- set to "en_US" there, and everything seems to work fine. (If you set
- it in your profile or the system-wide default, you'll need a fresh
- login for it to take effect, obviously.)
-
- See Also: 10. Pflogsumm misses/mis-diagnoses/mis-reports, etc.
- <whatever>
- 12. Pflogsumm just doesn't work or doesn't report anything
- 21. Pflogsumm doesn't understand my log file format
-
-
-20. How can I best format my custom reject messages for display in
- Pflogsumm's output?
-
- Reject reason strings found in the mail log will be truncated at the
- first comma (","), colon (":") or semi-colon (";"). If you want a
- "clause" in your reject message to appear in Pflogsumm's output,
- without having to specify --verbose-msg-detail, use a punctuation mark
- other than one of those three, such as a dash ("-").
-
-
-21. Pflogsumm doesn't understand my log file format
-
- I've received several requests to modify Pflogsumm's log file format
- regular expression matching to accommodate "non-standard" log file
- formats. I'm not inclined to honour such requests. The regexp that
- identifies Postfix' log file entries is nearly incomprehensible as it
- is. If your log file format has extra fields (e.g.: FreeBSD syslogd
- with "-v -v" specified), or, as in one case (metalog), is lacking
- fields, and you insist on doing things that way, I recommend you
- code-up a little pre-filter to mung the format into a standard one.
-
- See Also: 10. Pflogsumm misses/mis-diagnoses/mis-reports, etc.
- <whatever>
- 12. Pflogsumm just doesn't work or doesn't report anything
- 19. New Red Hat install - Pflogsumm no longer works!
-
-
-22. Why Isn't There Any Mention Of "Monkey Butler" In The FAQ?
-
- A friend of mine asked me if I'd put the phrase "monkey butler" in
- the FAQ. The answer is no. Pflogsumm is used by some rather large
- corporations. There are credibility issues. Sorry. :)
-
-
-23. Translating Pflogsumm (Support for Internationalization)
-
- Unfortunately, Pflogsumm doesn't currently have i18n support.
-
- It wasn't until at least Perl 5.6 that i18n was included as part of
- the base distribution. Since, last time I looked, 5.005* was still
- the most widely-used version of Perl (that's what I'm still running
- everywhere, too), I can't put i18n in without chancing breaking
- things right-and-left for the majority of my customers.
-
- Even with Perl 5.6 and above, it was mentioned in postfix-users, by
- Liviu Daia, that
-
- "Perl 5.6+ has locales. Locales can give you localized
- dates, charsets, standard error messages etc., but it
- won't automatically switch languages of the strings
- defined in your program. For that, you still need
- gettext or something equivalent."
-
- So I'm not clear on the future of i18n support in Pflogsumm. But I'm
- keeping an eye on things. Proper i18n support has long been one of
- the top things on my own wish list!
-
- Prospective translators are urged to translate *only* the
- stable/production versions. Beta and Alpha versions can sometimes
- change rapidly.
-
- If you do translate Pflogsumm, let me know and I'll put a link to it
- on Pflogsumm's main web page.
-
-
-24. Pflogsumm may sometimes calculate "yesterday" incorrectly
-
- As Wieland Chmielewski aptly noted:
-
- Subroutine get_datestr incorrectly assumes that each day of
- the year comprises 24 hours. In those countries which
- participate in Daylight Saving Time policy there is one day
- with 23 hours and one day with 25 hours. So, chances are (for
- 1 hour within those days) that get_datestr actually returns
- either "the day before yesterday" or "today" instead of
- "yesterday" as requested.
-
- Right you are, Wieland, and thanks for the catch.
-
- Problem is, of course, there's really no clean, easy, certain fix.
- The work-around is to stay well clear of DST never-never land with
- your cron jobs.
-
-
-25. Sending Logfile Samples
-
- Here's the deal with whatever you may send me in the way of log
- samples:
-
- . Obfuscate them if you want. But take care not alter them
- in such a manner that they're not accurate wrt the "realism" of
- the data, make sure the field formatting is not altered, and
- that the order of the log entries is not altered.
-
- . The world is an unsafe place for your data, no matter where
- it might reside. But I'll do my level best to ensure that your
- data does not fall into the hands of others.
-
- . If you want, I'll PGP-encrypt the data when it's not in
- use.
-
- . You can PGP-encrypt it when you send it to me if you're
- concerned. My PGP public key can be found on my Web site and at
- the PGP public key servers.
-
- . If you want, I'll delete the sample data when the work is
- done. But I would *like* to keep it around for future
- regression-testing. It's your call. Let me know.
-
-
-26. From Where Can I Obtain Pflogsumm?
-
- http://jimsun.LinxNet.com/postfix_contrib.html
-
-
-Created: 15 Feb., 1999 / Last updated: 22 March, 2010
.\" ========================================================================
.\"
.IX Title "PFLOGSUMM 1"
-.TH PFLOGSUMM 1 2026-04-22 1.2.1 "User Contributed Perl Documentation"
+.TH PFLOGSUMM 1 2026-09-15 1.3.0 "User Contributed Perl Documentation"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.SH NAME
pflogsumm \- Produce Postfix MTA logfile summary
.PP
-Copyright (C) 1998\-2026 by James S. Seymour, Release 1.2.1
-.SH "SYNOPSIS pflogsumm [\-\-config <file>] [\-\-bounce\-detail <cnt>] [\-\-colwidth <n>] [\-d|\-\-date\-range <date [range]>] [\-\-deferral\-detail <cnt>] [\-\-detail <cnt>] [\-\-dow0mon] [\-e|\-\-extended\-detail] [\-\-expired\-detail <cnt>] [\-h|\-\-host\-cnt <cnt>] [\-i|\-\-ignore\-case] [\-\-iso\-date\-time] [\-m|\-\-uucp\-mung] [\-\-mailq] [\-\-no\-no\-msg\-size] [\-\-problems\-first] [\-\-pscrn\-detail <cnt>] [\-\-pscrn\-stats] [\-q|\-\-quiet] [\-\-rej\-add\-from] [\-\-rej\-add\-to] [\-\-reject\-detail <cnt>] [\-\-smtpd\-stats] [\-\-srs\-mung] [\-\-ssl\-tls\-stats] [\-\-syslog\-name <string>] [\-u|\-\-user\-cnt <cnt>] [\-\-unprocd\-file <filename>] [\-\-use\-orig\-to] [\-\-verbose\-msg\-detail] [\-\-verp\-mung [n]] [\-\-warning\-detail <cnt>] [\-x|\-\-debug <file>] [\-\-zero\-fill] [file1 [filen]]"
-.IX Header "SYNOPSIS pflogsumm [--config <file>] [--bounce-detail <cnt>] [--colwidth <n>] [-d|--date-range <date [range]>] [--deferral-detail <cnt>] [--detail <cnt>] [--dow0mon] [-e|--extended-detail] [--expired-detail <cnt>] [-h|--host-cnt <cnt>] [-i|--ignore-case] [--iso-date-time] [-m|--uucp-mung] [--mailq] [--no-no-msg-size] [--problems-first] [--pscrn-detail <cnt>] [--pscrn-stats] [-q|--quiet] [--rej-add-from] [--rej-add-to] [--reject-detail <cnt>] [--smtpd-stats] [--srs-mung] [--ssl-tls-stats] [--syslog-name <string>] [-u|--user-cnt <cnt>] [--unprocd-file <filename>] [--use-orig-to] [--verbose-msg-detail] [--verp-mung [n]] [--warning-detail <cnt>] [-x|--debug <file>] [--zero-fill] [file1 [filen]]"
+Copyright (C) 1998\-2026 by James S. Seymour, Release 1.3.0
+.SH "SYNOPSIS pflogsumm [\-\-config <file>] [\-\-bounce\-detail <cnt>] [\-\-colwidth <n>] [\-d|\-\-date\-range <date [range]>] [\-\-deferral\-detail <cnt>] [\-\-detail <cnt>] [\-\-dow0mon] [\-e|\-\-extended\-detail] [\-\-expired\-detail <cnt>] [\-h|\-\-host\-cnt <cnt>] [\-i|\-\-ignore\-case] [\-\-iso\-date\-time] [\-m|\-\-uucp\-mung] [\-\-mailq] [\-\-no\-no\-msg\-size] [\-\-problems\-first] [\-\-pscrn\-detail <cnt>] [\-\-pscrn\-stats] [\-q|\-\-quiet] [\-\-rej\-add\-from] [\-\-rej\-add\-to] [\-\-reject\-detail <cnt>] [\-\-smtpd\-stats] [\-\-srs\-mung] [\-\-ssl\-tls\-stats] [\-\-syslog\-name <string>] [\-\-suppress <reports>|help] [\-u|\-\-user\-cnt <cnt>] [\-\-unprocd\-file <filename>] [\-\-use\-orig\-to] [\-\-verbose\-msg\-detail] [\-\-verp\-mung [n]] [\-\-warning\-detail <cnt>] [\-x|\-\-debug <file>] [\-\-zero\-fill] [file1 [filen]]"
+.IX Header "SYNOPSIS pflogsumm [--config <file>] [--bounce-detail <cnt>] [--colwidth <n>] [-d|--date-range <date [range]>] [--deferral-detail <cnt>] [--detail <cnt>] [--dow0mon] [-e|--extended-detail] [--expired-detail <cnt>] [-h|--host-cnt <cnt>] [-i|--ignore-case] [--iso-date-time] [-m|--uucp-mung] [--mailq] [--no-no-msg-size] [--problems-first] [--pscrn-detail <cnt>] [--pscrn-stats] [-q|--quiet] [--rej-add-from] [--rej-add-to] [--reject-detail <cnt>] [--smtpd-stats] [--srs-mung] [--ssl-tls-stats] [--syslog-name <string>] [--suppress <reports>|help] [-u|--user-cnt <cnt>] [--unprocd-file <filename>] [--use-orig-to] [--verbose-msg-detail] [--verp-mung [n]] [--warning-detail <cnt>] [-x|--debug <file>] [--zero-fill] [file1 [filen]]"
.Vb 1
\& pflogsumm \-\-[dump\-config|help|version]
\&
\& See the discussion about the use of this option under
\& "NOTES," below.
\&
+\& \-\-suppress <reports>
+\&
+\& Specify a space\-separated list of one\-or\-more reports
+\& to suppress in the output.
+\&
+\& Use "\-\-suppress help" to get a list of valid report
+\& section names.
+\&
\& \-\-ssl\-tls\-stats
\&
\& Report SMTP TLS statistics and SMTPD SSL/TLS errors.
pftobyfrom - List "to" addresses by "from" whom in Postfix log file
-Copyright (C) 2007-2025 by James S. Seymour, Release 1.3
+Copyright (C) 2007-2025 by James S. Seymour, Release $Revision: 1.3 $
=head1 SYNOPSIS
pftobyfrom -[bhrRv] <sender> [mailfile]
-R Hard rejects only
-v Emit version and exit";
-my $revision = '1.3';
+my $revision = '$Revision: 1.3 $';
use vars qw($opt_b $opt_h $opt_r $opt_R $opt_v);
.\" ========================================================================
.\"
.IX Title "PFTOBYFROM 1"
-.TH PFTOBYFROM 1 2025-05-22 1.2.1 "User Contributed Perl Documentation"
+.TH PFTOBYFROM 1 2026-09-15 1.3.0 "User Contributed Perl Documentation"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.SH NAME
pftobyfrom \- List "to" addresses by "from" whom in Postfix log file
.PP
-Copyright (C) 2007\-2025 by James S. Seymour, Release 1.3
+Copyright (C) 2007\-2025 by James S. Seymour, Release $Revision: 1.3 $
.SH "SYNOPSIS pftobyfrom \-[bhrRv] <sender> [mailfile]"
.IX Header "SYNOPSIS pftobyfrom -[bhrRv] <sender> [mailfile]"
.Vb 1
projects / sven / pflogsumm.git / commitdiff