On 8/11/2010 4:10 AM, Stan Hoeppner wrote:
Stan Hoeppner put forth on 8/11/2010 3:31 AM:I was just looking at a Logwatch summary. The data the OP is requesting _is_ in the Postfix logs somewhere, as Logwatch is tallying the disconnection phases: 81 Connections lost (inbound) 61 After DATA 11 After CONNECT 7 After RCPT 2 After EHLO If you need this information _per msg_ with detail, you'll have to go digging and figure it out for yourself. The data _is_ in there though. And, yes, I use smtpd_delay_reject=yes, the default.Found it. And not really hard to find: ~$ grep " lost connection " /var/log/mail.log|mawk {print'($6, $7, $8, $9, $10, $11, $12, $13)}' This won't tell you if/what restriction caused the disconnection, but you'll definitely know during which SMTP phase the disconnection occurred.
This is logged when the client disconnected in the middle of the transaction -- postfix lost the connection -- NOT a reject.
You won't find reject log entries for the lost connections after EHLO or CONNECT, although the ones for RCPT and DATA *might* be proceeded by rejects.
This can be confusing because typically most of the lost connections are zombies/bots that you would reject anyway.
-- Noel Jones
