Re: log analysis tool

[John Groseclose <iain@xxxxxxxxxxx>]

At 9:13 AM -0300 10/2/04, Leonardo Rodrigues Magalhães wrote:
>     Hello Guys,
>
>     We have several great tools for analysing postfix logs. But I've
> searched, found several people with the same problem and couldnt find an
> answer.
>
>     Is there ANY tool for analysing postfix logs that can deal with the
> 'doubled message' problem that happens when amavisd is used ? I couldnt find
> any answer neither solution for this .....

There's one solution that I've been using with good results...

Instead of having amavisd listen on 127.0.0.1, I set up another 127.0.0.x
address.

I've got that address in header checks with a directive to IGNORE any line
with that 127.0.0.x address in it.

When I run pflogsumm, I just grep -v 127.0.0.x and pipe the output through
pflogsumm, and it tosses out all of those extraneous lines. The results are
close enough that I'm not worried about them.