On Fri, Dec 01, 2000 at 11:07:51AM +0800, Wong, Wing-Kin wrote:
> Are there any relationship between the both qmail log files of qmail-smtpd
> and qmail-send?
No, there is no direct relationsship.
> If yes, how can i log the TCPREMOTEIP in the qmail-send log files?
There is no support for this.
What we do (for accounting) is compile qmail with an extra delivery.
>From FAQ
8.2. How do I keep a copy of all incoming and outgoing mail messages?
Answer: Set QUEUE_EXTRA to "Tlog\0" and QUEUE_EXTRALEN to 5 in extra.h.
Recompile qmail.
We have a ~alias/.qmail-log that contains the line
| awk '/^$/ { exit } /^[mM][eE][sS][sS][aA][gG][eE]-/ { print }
|/^[rR][eE][cC][eE][iI][vV][eE][dD]:/ { r=r+1; if (r==2) print; }'
Now the logfile shows lines like that
new msg 376799
info msg 376799: bytes 765 from <[EMAIL PROTECTED]> qp 20509 uid 101
starting delivery 570966: msg 376799 to local [EMAIL PROTECTED]
starting delivery 570975: msg 376799 to remote [EMAIL PROTECTED]
delivery 570966: success:
Received:_from_ns.space.net_(HELO_kronecker.space.net)_(195.30.0.1)/Message-ID:_<[EMAIL PROTECTED]>/did_0+0+1/
delivery 570975: success:
195.30.1.25_accepted_message./Remote_host_said:_250_ok_975625194_qp_27212/
end msg 376799
you can read that like that
msg 376799 -> delivery 570966 this is the extra
-> delivery 570975 this is the "normal"
The extra goes to the script and outputs
Received:_from_ns.space.net_..._(195.30.0.1)
and the Message-Id. You can now parse this line and extract the IP
address. This IP address belongs to the host that injected msg 376799
delivery 570966 -> msg 376799
and now you know a lot about the message 376799
size 765 bytes
from <[EMAIL PROTECTED]>
to [EMAIL PROTECTED]
Message-Id: <[EMAIL PROTECTED]>
From-IP: 195.30.0.1
You didn't write what you need the information for. Probably this can
be easier accomplished by patching qmail-smtpd.c
We've modified ours to output lines like
spamcheck: pid 24861: addrallowed: ns.space.net:195.30.0.1
1:<[EMAIL PROTECTED]> to <[EMAIL PROTECTED]>
Sorry, I can't provide a patch, as the modification is part of a heavily
hacked qmail-1.01 smtp server.
\Maex
--
SpaceNet AG | http://www.Space.Net/ | Stress is when you wake
Research & Development | mailto:[EMAIL PROTECTED] | up screaming and you
Joseph-Dollinger-Bogen 14 | Tel: +49 (89) 32356-0 | realize you haven't
D-80807 Muenchen | Fax: +49 (89) 32356-299 | fallen asleep yet.
