On 11/21/2016 2:46 PM, @lbutlr wrote: > I am wondering what the various possible types of events postscreen logs. I > checked man postsreen(8) but it doesn’t seem to give them. > > I know there are PASS NEW, PASS OLD, CONNECT, DISCONNECT, HANGUP, NOQUEUE, > COMMAND, cache, and DNSBL. Any others I am missing? > > Are these documented in some other man page?
Most of this is covered in the readme: http://www.postfix.org/POSTSCREEN_README.html > > (Currently I’m interested int he difference between HANGUP and DISCONNECT and > NOQUEUE and why sometimes hosts that connect thousands of times with high RBL > scores don’t necessarily get HANGUP.) HANGUP: the client disconnected unexpectedly. Spambots often do this after a recipient is rejected. DISCONNECT: postscreen is done with the client and did not pass the connection to smtpd NOQUEUE: if you've configured postfix to log the sender/recipient of a rejected message (enforce), this is both a placeholder for the queue id and a reminder the message was not queued. If you've configured postscreen with "enforce", it's not unusual for all three of the above to be logged for a particular client connection. As you see, HANGUP is something the client does, not a postscreen action. -- Noel Jones
