On 03/13/2015 01:06 PM, Blake Hudson wrote:
ken wrote on 3/13/2015 11:36 AM:
# rpm -q sendmail logwatch sendmail-8.13.8-8.1.el5_7 logwatch-7.3-10.el5
One host sends just one email per day, the daily logwatch report. Here's /var/log/maillog entries from yesterday (hostnames are changed to make designations in this conversation more intuitive):
Mar 12 04:02:18 srchost sendmail[27151]: t2C82Bjr027151: from=root, size=2485, class=0, nrcpts=1, msgid=201503120802.t2C82Bjr027151@localhost.localdomain, relay=root@localhost Mar 12 04:02:19 srchost sendmail[27383]: t2C82IiB027383: from=root@localhost.localdomain, size=2756, class=0, nrcpts=1, msgid=201503120802.t2C82Bjr027151@localhost.localdomain, proto=ESMTP, daemon=MTA, relay=srchost [127.0.0.1] Mar 12 04:02:19 srchost sendmail[27151]: t2C82Bjr027151: to=recip@dest, ctladdr=root (0/0), delay=00:00:08, xdelay=00:00:01, mailer=relay, pri=32485, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (t2C82IiB027383 Message accepted for delivery) Mar 12 04:02:20 srchost sendmail[27385]: t2C82IiB027383: to=recip@dest.com, ctladdr=root@localhost.localdomain (0/0), delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=122756, relay=dellap.mousecar.net. [192.168.0.26], dsn=2.0.0, stat=Sent (t2C82Jh3016227 Message accepted for delivery) Mar 13 04:02:13 srchost sendmail[30541]: t2D82ATM030541: from=root, size=2589, class=0, nrcpts=1, msgid=201503130802.t2D82ATM030541@localhost.localdomain, relay=root@localhost
These four lines describe the sending of just one email. (The loglevel for sendmail is set at 9, the default.) I don't know why, but logwatch reports that two emails were sent yesterday. Could it be because there are two distinct msgids? Here's the relevant section of the logwatch report:
--------------------- sendmail Begin ------------------------
STATISTICS
Bytes Transferred: 5241 Messages Processed: 2 Addressed Recipients: 2
---------------------- sendmail End -------------------------
I'd also like to know where/how logwatch is getting the number for "Bytes Transferred"; it doesn't seem to correspond to anything.
So, unless I'm missing something, that's two problems. Does anyone see any others...? or have a plausible explanation for these inconsistencies?
tia.
Ken, the bytes transferred looks to be the size of the first two log entries (2485 + 2756 = 5241). I'm not sure what logwatch considers individual messages in its sendmail stats, but a unique message ID does indicate a unique message. I also want to point out that if your logwatch is generating an email, this may be counted in the stats also (how, I'm not sure). If logwatch is running at 4AM, when these emails are being sent, I could also anticipate some problems, depending on the timing involved and when log entries are committed to the log. Overall, I wouldn't be concerned.
--Blake
My major concern is accuracy. I mean, there's not much sense in using logwatch if what it's telling me is wrong.
The fact that logwatch runs at 4am shouldn't be the problem here, as logwatch is culling data from the previous day. So no conflict there (if that's what you were implying).
You're right about the Bytes Transferred number. "size" is mentioned *three* times in maillog. It's just another curiosity how logwatch picked the two numbers that it did. However it did it, obviously it's double-counting, so logwatch is getting that number wrong as well.