logwatch seems to have problems with "enable_long_queue_ids" at the end one log entry from /var/log/maillog the big benefit with this setting is that IDs are no longer repeated which makes grep for a specific message much easier on servers with high message load _______________________________ logwatch reports many lines with "**Unmatched Entries**" current pflogsum versions have no probblem with it http://jimsun.linxnet.com/postfix_contrib.html _______________________________ http://www.postfix.org/postconf.5.html enable_long_queue_ids Enable long, non-repeating, queue IDs (queue file names). The benefit of non-repeating names is simpler logfile analysis and easier queue migration (there is no need to run "postsuper" to change queue file names that don't match their message file inode number). _______________________________ [root@mail:~]$ cat maillog | grep 3W0k3d3CWqz3V May 27 16:24:29 mail postfix/smtpd[17843]: 3W0k3d3CWqz3V: client=unknown[10.0.0.20] May 27 16:24:29 mail postfix/cleanup[17844]: 3W0k3d3CWqz3V: message-id=<4FC2390D.3000501> May 27 16:24:29 mail postfix/qmgr[17520]: 3W0k3d3CWqz3V: from=<dovecot-bounces>, size=5155, nrcpt=1 (queue active) May 27 16:24:29 mail postfix/lmtp[17845]: 3W0k3d3CWqz3V: to=<h.reindl>, relay=127.0.0.1[127.0.0.1]:24, delay=0.27, delays=0.05/0.01/0/0.21, dsn=2.0.0, status=sent (215 Recipient <h.reindl> OK) May 27 16:24:29 mail postfix/qmgr[17520]: 3W0k3d3CWqz3V: removed
the same with logwatch-7.4.0-13.20120619svn110.fc17.noarch is there a way to disable postfix/dovecot completly for logwatch? it makes much more troubles as it solves by receive logwatch mails with 5 MB each day and there are much better tools like "pflogsum" which handles maillogs in a clean and confugureable way
You can add the following line to /etc/logwatch/conf/logwatch.conf if you want to ignore some of the services: # don't process dovecot and postfix logs Service = "-dovecot" Service = "-postfix" You can also specify regular expressions you don't want to be included in the report in /etc/logwatch/conf/ignore.conf.
There is no problem with long_queue_ids in logwatch. This functionality is disabled by default. $ cat /usr/share/logwatch/default.conf/services/postfix.conf | grep -i long_queue_ids # Postfix option: enable_long_queue_ids $postfix_Enable_Long_Queue_Ids = No You can enable it in a local configuration file: /etc/logwatch/conf/services/postfix.conf (Or you can overwrite the value in /usr/share/logwatch/default.conf/services/postfix.conf, but that gets overwritten everytime you update the package.)