Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Counting Connections Accepted/Denied in qmail
- Thread starter japelaez
- Start date
Connections to qmail" - let's define that as SMTP connections for the sake of conversation. (we eliminate POP3, IMAP and other ways that a server providing local mail services might also be "counting connections")
Most install instructions for qmail will specify separate logs for incoming- and outgoing-SMTP traffic.
incoming might be found in
/var/log/qmail/smtpd
and outgoing in
/var/log/qmail/send
So in the smtpd logfile 'current' you would see lines like:
@40000000464b298914ca614c tcpserver: pid 9890 .........
In my opinion you could script to parse the log with
and then use a regexp to find the entries for a specific day/hour. This would *potentially* give you a good estimate of how many connections via incoming SMTP are being processed.
Outgoing smtp/send would also be in the corresponding 'current' log and would probably be best "grepped" using a pattern like
" starting delivery"
The *problem* with counting entries in the 'send' log is that a vpopmail installation (and potentially other solutions that revolve around aliases from local-to-local mailboxes) is that you will normally double-count the event of receiving and delivering mail on local accounts.
For example, if "bob@example.com" and "jane@example2.com" are both vpopmail users on the same server, qmail-send will require TWO deliveries to get from bob to jane.
Similarly if "jane" were an alias to "wanda" you would also incur two deliveries in the logs even on a regular qmail system.
Therefore, counting qmail-send log entries is a bit risky to establish real metrics. You might find that a firewall log of accesses to external port 25 might be more helpful if you need some precision.
Hope that helps.
D.
D.E.R. Management - IT Project Management Consulting
Most install instructions for qmail will specify separate logs for incoming- and outgoing-SMTP traffic.
incoming might be found in
/var/log/qmail/smtpd
and outgoing in
/var/log/qmail/send
So in the smtpd logfile 'current' you would see lines like:
@40000000464b298914ca614c tcpserver: pid 9890 .........
In my opinion you could script to parse the log with
Code:
cat current | grep 'tcpserver: pid ' | tai64nlocalOutgoing smtp/send would also be in the corresponding 'current' log and would probably be best "grepped" using a pattern like
" starting delivery"
The *problem* with counting entries in the 'send' log is that a vpopmail installation (and potentially other solutions that revolve around aliases from local-to-local mailboxes) is that you will normally double-count the event of receiving and delivering mail on local accounts.
For example, if "bob@example.com" and "jane@example2.com" are both vpopmail users on the same server, qmail-send will require TWO deliveries to get from bob to jane.
Similarly if "jane" were an alias to "wanda" you would also incur two deliveries in the logs even on a regular qmail system.
Therefore, counting qmail-send log entries is a bit risky to establish real metrics. You might find that a firewall log of accesses to external port 25 might be more helpful if you need some precision.
Hope that helps.
D.
D.E.R. Management - IT Project Management Consulting
- Status
Similar threads
- Locked
- Question
- Locked
- Question
- Locked
- Question