--- What qmailanalog needs from your log
Before using qmailanalog, make sure that your qmail log contains
microsecond timestamps: e.g.,
901967408.113926 new msg 19287
901967408.116537 info msg 19287: bytes ...
Several programs can generate these timestamps: splogger, accustamp,
logger2, etc. The default qmail installation sends logs through splogger
and then through syslogd:
Aug 1 05:30:08 host qmail: 901967408.113926 new msg 19287
Aug 1 05:30:08 host qmail: 901967408.116537 info msg 19287: bytes ...
To remove the "Aug 1 05:30:08 host qmail:" added by syslogd, feed your
logs through
awk '{$1="";$2="";$3="";$4="";$5="";print}'
Note that the syslog mechanism is inherently unreliable: it does not
guarantee that all messages will be logged. For reliable logs, try the
logging utilities in the daemontools package.
--- Feeding the log through matchup
The qmailanalog/bin/matchup program monitors qmail's delivery attempts.
It prints various information in a form suitable for further analysis.
If you have saved the complete qmail log, you can simply run matchup
with the log as input, and use the matchup output as described below.
Running matchup again and again on a growing log is unnecessarily slow.
You can save time by breaking the log into a series of chunks and
running matchup just once on each chunk. (You can also save space by
discarding a chunk once matchup is done with it.) Note that matchup
keeps track of messages and delivery attempts across chunks; see the
matchup man page for the correct command lines.
You could pipe qmail's log directly through matchup before it is logged,
Beware, however, that matchup will quit if it runs out of memory.
--- Using the matchup results
You can feed the matchup output through any of the qmailanalog/bin/z*
scripts. Each script explains its output. Use zoverall for basic
statistics, zsendmail for a sendmail-flavored log.
The qmailanalog/bin/x* scripts extract information about particular
messages, senders, or recipients. You can feed the x* output through the
z* scripts.
|