Robert Brooks wrote:
> MrC wrote:
>> Robert Brooks wrote:
> [..] (discussing postfix-logwatch log analyser)
>>> whilst I'm being a pain the Postfix reject figures don't show
>>> rejections from before-queue amavis. Unfortunately Postfix doesn't
>>> seem to log this well :(
>> I don't use a before-queue setup, and don't know what log entries you
>> have. Feel free to send the my way if you think there is any useful
>> information there. I can only report on information present in the log.
> Postfix picks up the connection:
> Oct 5 09:00:54 mailhost postfix/smtpd: connect from
> Oct 5 09:00:55 mailhost postfix/smtpd: NOQUEUE:
> amavis rejects the email:
> Oct 5 09:01:06 mailhost amavis: (25870-17) Blocked SPAM,
> [18.104.22.168] [22.214.171.124] <JohannahorseRushing@...> ->
> <user@...>, mail_id: HFW3sN8D+u30, Hits: 20.862, size: 719,
> 11887 ms
> postfix logs the client disconnecting:
> Oct 5 09:01:07 mailhost postfix/smtpd: disconnect from
This is what I expected.
> A line from Postfix along the lines of:
> Oct 5 10:58:09 mailhost postfix/smtpd: NOQUEUE: reject: RCPT
> from pool-72-79-133-202.sctnpa.east.verizon.net[126.96.36.199]: Proxy
> filter said "554 5.7.0 Reject, id=25870-18-2 - SPAM"
> would be perfect, I'm not sure how likely a wish it is.
Doubtful. This would probably require changing postfix internals to log
the fiction that it was smtpd that did the rejecting.
> Other than that you'd have to infer from the amavis log line and some
> indication to postfix-logwatch of amavis's role.
Without data in the log that supports such an inference, there's nothing
that can be concluded. Neither utility is aware of the other and
neither tries to piece together the relationship between past log
entries to construct a chain of events.
> I'm tempted to cross-post to postfix-users, however that's bad form. I
> hope cc'ing Wietse won't incur too much wrath.