On Thu, 9 Nov 2006, Philip Hazel wrote:
>
> > If each log line could have some pid=4711 (or whatever the key is named)
> > it could help to reproduce what happend with sessions if they didn't get
> > the 'spool id' assigned yet.
>
> There is a (vauge) wish to assign an id earlier than now, which would
> help a bit. But it makes no sense to assign a message id until a MAIL
> command is received.
>
> If you turn on log_selector=+smtp_connection the log will contain a
> start and end connection line. Using the IP address this should help
> sort out an individual connection, though I guess if a client makes two
> or more simultaneous connections it won't be clear.
>
> Adding a PID would not be liked by those whose log files are already
> many megabytes long, but of course it would be an option. In the past I
> would have just added this idea to the Wish List, but now that it is in
> Bugzilla it is probably better if you add it, because then its origin
> will be properly recorded.
>
I must be missing something - my exim logs contain a PID, and I use a
homegrown script to grab log snippets. Example:
(yeah, I know this doesn't look like stock exim logging - I went a
little crazy w/ my config when I was setting things up a couple of
years ago ;)
Nov 9 04:42:35 spot exim[14930]: conn:"sesame.csx.cam.ac.uk" [131.111.8.41:1196::25]
Nov 9 04:42:35 spot exim[14930]: helo:"sesame.csx.cam.ac.uk"
Nov 9 04:42:36 spot exim[14930]: orig:<exim-users-bounces+dlugo=etherboy.com@???>
Nov 9 04:42:36 spot exim[14930]: rcpt:<dlugo@???> [u-wl-mf]
Nov 9 04:42:36 spot exim[14930]: 1Gi6Qe-0003so-Gz subj:"Re: [exim] wishlist: log_selector for PID"
Nov 9 04:42:36 spot exim[14930]: 1Gi6Qe-0003so-Gz size: 3233 [u-wl-mf]
Nov 9 04:42:36 spot exim[14930]: 1Gi6Qe-0003so-Gz <= exim-users-bounces+dlugo=etherboy.com@??? H=sesame.csx.cam.ac.uk [131.111.8.41]:1196 P=esmtp S=3504 id=Pine.LNX.4.64.0611090935120.18921@??? for dlugo@???
Nov 9 04:42:37 spot exim[14930]: quit
Nov 9 06:56:00 spot exim[17065]: conn:"sesame.csx.cam.ac.uk" [131.111.8.41:3692::25]
Nov 9 06:56:00 spot exim[17065]: helo:"sesame.csx.cam.ac.uk"
Nov 9 06:56:00 spot exim[17065]: orig:<exim-users-bounces+dlugo=etherboy.com@???>
Nov 9 06:56:00 spot exim[17065]: rcpt:<dlugo@???> [u-wl-mf]
Nov 9 06:56:01 spot exim[17065]: 1Gi8Vk-0004RF-Oy subj:"Re: [exim] wishlist: log_selector for PID"
Nov 9 06:56:01 spot exim[17065]: 1Gi8Vk-0004RF-Oy size: 4692 [u-wl-mf]
Nov 9 06:56:01 spot exim[17065]: 1Gi8Vk-0004RF-Oy <= exim-users-bounces+dlugo=etherboy.com@??? H=sesame.csx.cam.ac.uk [131.111.8.41]:3692 P=esmtp S=4963 id=20061109115341.GV8898@??? for dlugo@???
Nov 9 06:56:01 spot exim[17065]: quit
Nov 9 09:33:13 spot exim[19167]: conn:"sesame.csx.cam.ac.uk" [131.111.8.41:2571::25]
Nov 9 09:33:13 spot exim[19167]: helo:"sesame.csx.cam.ac.uk"
Nov 9 09:33:13 spot exim[19167]: orig:<exim-users-bounces+dlugo=etherboy.com@???>
Nov 9 09:33:13 spot exim[19167]: rcpt:<dlugo@???> [u-wl-mf]
Nov 9 09:33:14 spot exim[19167]: 1GiAxt-0004z9-Rp subj:"Re: [exim] wishlist: log_selector for PID"
Nov 9 09:33:14 spot exim[19167]: 1GiAxt-0004z9-Rp size: 3891 [u-wl-mf]
Nov 9 09:33:14 spot exim[19167]: 1GiAxt-0004z9-Rp <= exim-users-bounces+dlugo=etherboy.com@??? H=sesame.csx.cam.ac.uk [131.111.8.41]:2571 P=esmtp S=4162 id=45533C43.1080109@??? for dlugo@???
Nov 9 09:33:14 spot exim[19167]: quit
Nov 8 13:31:10 spot exim[24212]: conn:"sesame.csx.cam.ac.uk" [131.111.8.41:2198::25]
Nov 8 13:31:11 spot exim[24212]: helo:"sesame.csx.cam.ac.uk"
Nov 8 13:31:13 spot exim[24212]: orig:<exim-users-bounces+dlugo=etherboy.com@???>
Nov 8 13:31:13 spot exim[24212]: rcpt:<dlugo@???> [u-wl-mf]
Nov 8 13:31:14 spot exim[24212]: 1GhsCf-0006IW-JV subj:"[exim] wishlist: log_selector for PID"
Nov 8 13:31:14 spot exim[24212]: 1GhsCf-0006IW-JV size: 4259 [u-wl-mf]
Nov 8 13:31:14 spot exim[24212]: 1GhsCf-0006IW-JV <= exim-users-bounces+dlugo=etherboy.com@??? H=sesame.csx.cam.ac.uk [131.111.8.41]:2198 P=esmtp S=4530 id=20061108182717.GO8898@??? for dlugo@???
Nov 8 13:31:14 spot exim[24212]: quit
Nov 8 15:08:18 spot exim[26036]: conn:"sesame.csx.cam.ac.uk" [131.111.8.41:1113::25]
Nov 8 15:08:18 spot exim[26036]: helo:"sesame.csx.cam.ac.uk"
Nov 8 15:08:19 spot exim[26036]: orig:<exim-users-bounces+dlugo=etherboy.com@???>
Nov 8 15:08:19 spot exim[26036]: rcpt:<dlugo@???> [u-wl-mf]
Nov 8 15:08:19 spot exim[26036]: 1Ghtid-0006lw-GY subj:"Re: [exim] wishlist: log_selector for PID"
Nov 8 15:08:19 spot exim[26036]: 1Ghtid-0006lw-GY size: 4012 [u-wl-mf]
Nov 8 15:08:19 spot exim[26036]: 1Ghtid-0006lw-GY <= exim-users-bounces+dlugo=etherboy.com@??? H=sesame.csx.cam.ac.uk [131.111.8.41]:1113 P=esmtp S=4283 id=4552395E.3030101@??? for dlugo@???
Nov 8 15:08:19 spot exim[26036]: quit
exiting
If anyone would like a copy of my horribly inefficent greplog,
drop me a line...
--
--------------------------------------------------------
Dave Lugo dlugo@??? LC Unit #260 TINLC
Have you hugged your firewall today? No spam, thanks.
--------------------------------------------------------
Are you the police? . . . . No ma'am, we're sysadmins.
