-
-
Notifications
You must be signed in to change notification settings - Fork 3
matchup.1
matchup - collect information on messages and deliveries
matchup
matchup reads a series of lines from qmail-send, with a numeric timestamp (microsecond or tai64n) in front of each line allowing either splogger(8) or multilog(8) to produce the logfiles. matchup matches the end of each delivery attempt with the start of the delivery attempt and with the relevant message information; it replaces qmail-send's message reports and delivery reports with message lines and delivery lines in the format described below.
qmail log will contains microsecond timestamps: e.g.,
901967408.113926 new msg 19287 901967408.116537 info msg 19287: bytes ...
or tai64n timestamps: e.g.,
@40000000477f63f537146144 new msg 9101014 @40000000477f63f5371474cc info msg 9101014: bytes ...
Several programs can generate these timestamps: splogger, accustamp, logger2, etc. The default qmail installation sends logs through splogger and then through syslogd:
Aug 1 05:30:08 host qmail: 901967408.113926 new msg 19287 Aug 1 05:30:08 host qmail: 901967408.116537 info msg 19287: bytes ...
To remove the "Aug 1 05:30:08 host qmail:" added by syslogd, feed your logs through
awk '{$1="";$2="";$3="";$4="";$5="";print}'
Note that the syslog mechanism is inherently unreliable: it does not guarantee that all messages will be logged. For reliable logs, try the logging utilities in the daemontools package.
If you are using daemontools package to log qmail's deliveries, use matchup as a processor in multilog.
The matchup program monitors qmail's delivery attempts. It prints various information in a form suitable for further analysis.
If you have saved the complete qmail log, you can simply run matchup with the log as input, and use the matchup output as described below.
Running matchup again and again on a growing log is unnecessarily slow. You can save time by breaking the log into a series of chunks and running matchup just once on each chunk. (You can also save space by discarding a chunk once matchup is done with it.) Note that matchup keeps track of messages and delivery attempts across chunks.
You could pipe qmail's log directly through matchup before it is logged, Beware, however, that matchup will quit if it runs out of memory.
You can feed the matchup output through any of the z* scripts. Each script explains its output. Use zoverall for basic statistics, zsendmail for a sendmail-flavored log.
The x* scripts extract information about particular messages, senders, or recipients. You can feed the x* output through the z* scripts.
To see who is generating outgoing mail you can use zsuids, which provides one line of statistics for each uid. Incoming mail is shown under the qmaild uid.
matchup exits after it sees end of file. It prints pending messages and deliveries on descriptor 5, in a format suitable for input to a future invocation of matchup:
<log.1 matchup >out.1 5>pending.2
cat pending.2 log.2 | matchup >out.2 5>pending.3
cat pending.3 log.3 | matchup >out.3 5>pending.4
Note that the 5> notation does not work with csh.
A message line summarizes the delivery results for a message that has left the queue:
m birth done bytes nk nz nd <sender> qp uid
Here birth and done are timestamps, bytes is the number of bytes in the message, nk is the number of successful deliveries, nz is the number of deferred delivery attempts, nd is the number of failed delivery attempts, sender is the message's return path, qp is the message's long-term queue identifier, and uid is the userid of the user that queued the message.
Note that matchup converts sender to lowercase. This can lose information, since a few hosts pay attention to the case in the box part of an address.
A delivery line shows the result of a single delivery attempt:
d result birth dstart ddone bytes
<sender> chan.recip qp uid reason
Here birth, bytes, sender, qp, and uid are message information as above; chan is the channel for this delivery; recip is the recipient address for this delivery; dstart and ddone are timestamps; result is the letter k for success, z for deferral, d for failure; and reason is a more detailed explanation of the delivery result.
matchup converts recip to lowercase.
xqp(1), xrecipient(1), xsender(1), accustamp(1) qmail-log(5), splogger(8), tai64n(8), tai64nunix(8), multilog(8),