FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.

» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Debian > Debian User

LinkBack Thread Tools
Old 07-22-2010, 09:39 AM
Stanisław Findeisen
Default Logwatch + Postfix + Mailman


I have several simple questions regarding Logwatch reporting on Postfix
logs with Mailman involved, too.

(1) How does Logwatch work? Suppose an attacker manages to break into
the machine and deletes/changes parts of the logs. Will Logwatch get
tricked by this or not?
I guess Logwatch is just run periodically from cron, so the answer is yes...

(2) This is what appeared in my logwatch today:

> ################### Logwatch 7.3.6+cvs20080702-debian (07/02/08) ####################
> Processing Initiated: Thu Jul 22 09:30:47 2010
> Date Range Processed: yesterday
> ( 2010-Jul-21 )
> Period is day.
> [...]
> --------------------- Postfix Begin ------------------------
> 1 *Warning: Queue file size limit exceeded
> 16.730M Bytes accepted 17,542,489
> 29.163M Bytes sent via SMTP 30,579,186
> 8.382M Bytes delivered 8,788,693
> ======== ================================================

I'd like to understand the numbers. :-)

First, the traffic yesterday was really low. With one exception: I have
a Mailman mailing list, and 1 subscriber (Ilona) sent to it an e-mail
with about 4 MB in size. So, the e-mail was delivered to:

1. a Mailman command
2. a local mailbox of list member (just 1)
3. 7 non-local mailing list members:
3x gmail.com
1x gazeta.pl relay=ASPMX.L.GOOGLE.COM
3 other servers (all diferent).

The question is, how does this sum up to the Logwatch/Postfix numbers above.

* Does delivery to the mailman command and delivery to a local mailbox
(after mailman command execution) count each on its own, so there should
be ca. 4 MB + 4 MB? Or only the submission to the mailman command
counts, so there should be just 4 MB?

* Does 29 MB ("sent via SMTP") comes from 7 * 4 MB? As I said there are
3 Gmail members, so that would mean that they all add up. How many times
is e-mail body physically transmitted over the network in such a case?

* I have no idea where does 16.7 MB accepted comes from, though. However
before successful 4 MB submission by Ilona someone tried to send in an
e-mail that was too big:

> Jul 21 12:11:26 smtpd[31280]: connect from mail-ww0-f46.google.com[]
> Jul 21 12:11:26 smtpd[31280]: 2E..36: client=mail-ww0-f46.google.com[]
> Jul 21 12:11:26 cleanup[31284]: 2E..36: message-id=<AANLk...Ux@mail.gmail.com>
> Jul 21 12:11:34 smtpd[31280]: warning: 2E..36: queue file size limit exceeded
> Jul 21 12:11:39 smtpd[31280]: disconnect from mail-ww0-f46.google.com[]

Does this failed submission count as "bytes accepted"??

What was its size??

Thank you!


OpenPGP: DFD9 0146 3794 9CF6 17EA D63F DBF5 8AA8 3B31 FE8A

Thread Tools

All times are GMT. The time now is 02:21 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org