<div dir="ltr">I recommend that instead of using the optional header "Subject", that you use a header that will always exist.<div>e.g.</div><div><br></div><div>/^Received:/ WARN<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 22, 2016 at 1:31 PM, <span dir="ltr"><<a href="mailto:russell@central-data.net" target="_blank">russell@central-data.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Another option in my case postfix you can modify the config to you get one nice line in the logs which makes it very easy to search and pull out reports<br>
<br>
In postfix.conf add<br>
header_checks = regexp:/etc/postfix/header_<wbr>checks<br>
<br>
in header_checks add<br>
/^Subject:/ WARN<br>
<br>
This will put a single line in your logs like the following<br>
<br>
warning: header Subject: "Subject line"[src ip addr]; from=<<a href="mailto:src@address.com">src@address.com</a>> to=<<a href="mailto:dst@address.com">dst@address.com</a>> proto=ESMTP helo=<src server><br>
<br>
<br>
<br>
<br>
Kind Regards,<br>
<br>
Russell Brooks<br>
<br>
<br>
Central Data Systems Pty Ltd<br>
88 Havelock Street, West Perth, WA 6005<br>
Phone: 08 9481 4010<br>
<br>
<a href="http://www.central-data.net" rel="noreferrer" target="_blank">www.central-data.net</a><br>
<span class="im HOEnZb"><br>
----- Original Message -----<br>
From: "Ross Wheeler" <<a href="mailto:ausnog@rossw.net">ausnog@rossw.net</a>><br>
To: "Mike O'Connor" <<a href="mailto:mike@pineview.net">mike@pineview.net</a>><br>
Cc: "<<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>>" <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
Sent: Tuesday, November 22, 2016 10:46:41 AM<br>
Subject: Re: [AusNOG] Data Retention - are you kidding me??<br>
<br>
<br>
<br>
</span><div class="HOEnZb"><div class="h5">On Tue, 22 Nov 2016, Mike O'Connor wrote:<br>
<br>
> On 17/11/2016 10:28 AM, Ross Wheeler wrote:<br>
<br>
> My problem is I have no idea how I would filter the results to just one<br>
> customer say in the case of mail logs. I was looking at the output of our<br>
> mail server and the details are split over a number of lines and in most<br>
> cases the information is not there.<br>
<br>
Certainly in the case of sendmail (and I suspect most MTAs), it would<br>
require a small amount of scripting - but still easy enough to achieve.<br>
<br>
An example:<br>
<br>
# grep <a href="mailto:mike@pineview.net">mike@pineview.net</a> /var/log/maillog<br>
<br>
Nov 22 12:55:45 ali-syd-1 sm-mta[76593]: uAM1tibu076593:<br>
from=<<a href="mailto:mike@pineview.net">mike@pineview.net</a>>, size=1534, class=0, nrcpts=1,<br>
msgid=<<a href="mailto:dccb7790-48e1-fccd-0b44-776623461f1e@pineview.net">dccb7790-48e1-fccd-<wbr>0b44-776623461f1e@pineview.net</a><wbr>>,<br>
bodytype=8BITMIME, proto=ESMTP, daemon=IPv4, relay=<a href="http://mail.pineview.net" rel="noreferrer" target="_blank">mail.pineview.net</a><br>
<a href="tel:%5B203.33.246.11" value="+12033324611">[203.33.246.11</a>]<br>
<br>
The "uAM1tibu076593" identifier is unique for this transaction.<br>
A second pass will find all the lines for this transaction, including<br>
lines that didn't contain the original search term (mike@)<br>
<br>
<br>
# grep uAM1tibu076593 /var/log/maillog<br>
<br>
Nov 22 12:55:45 ali-syd-1 milter-greylist: uAM1tibu076593: skipping<br>
greylist because recipient <<a href="mailto:ausnog@rossw.net">ausnog@rossw.net</a>> is whitelisted,<br>
(from=<<a href="mailto:mike@pineview.net">mike@pineview.net</a>>, rcpt=<<a href="mailto:ausnog@rossw.net">ausnog@rossw.net</a>>,<br>
addr=<a href="http://mail.pineview.net" rel="noreferrer" target="_blank">mail.pineview.net</a><a href="tel:%5B203.33.246.11" value="+12033324611">[203.33.246.11</a>])<br>
<br>
Nov 22 12:55:45 ali-syd-1 sm-mta[76593]: uAM1tibu076593:<br>
from=<<a href="mailto:mike@pineview.net">mike@pineview.net</a>>, size=1534, class=0, nrcpts=1,<br>
msgid=<<a href="mailto:dccb7790-48e1-fccd-0b44-776623461f1e@pineview.net">dccb7790-48e1-fccd-<wbr>0b44-776623461f1e@pineview.net</a><wbr>>,<br>
bodytype=8BITMIME, proto=ESMTP, daemon=IPv4, relay=<a href="http://mail.pineview.net" rel="noreferrer" target="_blank">mail.pineview.net</a><br>
<a href="tel:%5B203.33.246.11" value="+12033324611">[203.33.246.11</a>]<br>
<br>
Nov 22 12:55:45 ali-syd-1 sm-mta[76593]: uAM1tibu076593: Milter add:<br>
header: X-Greylist: Recipient e-mail whitelisted, not delayed by<br>
milter-greylist-3.0 (<a href="http://mail.albury.net.au" rel="noreferrer" target="_blank">mail.albury.net.au</a> [202.3.36.15]); Tue, 22 Nov<br>
2016 12:55:45 +1100 (EST)<br>
<br>
Nov 22 12:55:45 ali-syd-1 sm-mta[76724]: uAM1tibu076593:<br>
to=*******,*******, delay=00:00:00, xdelay=00:00:00, mailer=local,<br>
pri=61930, relay=local, dsn=2.0.0, stat=Sent<br>
<br>
<br>
<br>
The process of finding all the unique IDs for mail to or from a given user<br>
is quite straightforward using CLI tools available on every system I know<br>
of that you're likely to be running a mail server on :)<br>
<br>
Eg, a totally brute-force and ugly version:<br>
<br>
for id in `grep "<a href="mailto:whoever@example.com">whoever@example.com</a>" /var/log/maillog|awk '{print $6}'|sort|uniq`; do grep $id /var/log/maillog; done<br>
<br>
______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
</div></div></blockquote></div><br></div></div>