12. Logging

s/qmail follows qmail attitude to use entirely Unix file discriptors for logging. Thus, it does not possess any network capabilities to feed a remote SYSLOG server, rather additional programs are required to do so.

The purpose of logging is to provide:

• Usage information - in particular for qmail-send,
• Abuse information - regarding SPAM and viruses for mainly qmail-smtpd,
• Capacity information - given the setup of the servers.

From here, you can get

• statistics on the general behavior of s/qmail regarding on medium- (qmail-mrtg) and long-time (newanalyse) informations
• and perhaps an alerting invoking a proprietory analysis.

However,

• never, any proprietory information like passwords are disclosed and logged.

s/qmail uses different logging schemes:

1. qmail-send feeds the queue whether invoked by qmail-local or qmail-remote and uses the standard qmail format.
2. The servers qmail-smtpd and qmail-pop3d use SPAMCONTROLS's logging message format.
3. The servers qmail-qmtpd and qmail-qmqpd act 'logging-free', thus any logging is provided by means of tcpserver and sslserver only.

Quick links:

• 12.1 s/qmail logging strategies
• 12.2 qmail-send
• 12.3 qmail-smtpd
• 12.4 qmail-qmtpd
• 12.5 qmail-qmqpd
• 12.6 qmail-pop3d
• 12.7 qmail-mrtg
• 12.8 Analysis qmail-send log files
• 12.9 Newanalyse

12.1 s/qmail logging strategies

If you run a MTA, it is your responsibility to care for its performance.

You also need to care about successful and unsuccessful delivieries. Both on an statistical manner but probably more importent using some kind of on-line monitoring and alarming.

s/qmail's log help you to do this task, but given a busy system you need to setup your own procedures. DJB's multilog is still the best choice. systemds journald is ok for small traffic but IMHO not targeted for application logging.

12.2 qmail-send

The qmail-send's logging uses the following tokens:

• msg 28857444 providing the node-id.
• delivery 1356 telling the delivery number since start of the qmail-send instance.
• qp is the pid of the delivery process.
• uid ist the userid triggering the delivery.

The qmail-send log also provides the delivery channel and the number of used/possible delivery instances:

• local
• remote

A service generic multilog run script is provided. Use the respective qmail-smtpd run script for feeding the log.

Note: Given the many qmail-remote and qmail-local instances running concurrently and the monotone written log by means of multilog, mail transactions don't usually appear contiguous, but rather are splited over many lines and perhaps several qmail-send log files.

12.3 qmail-smtpd

Normally, qmail-smtpd doesn't log anything. Within s/qmail, qmail-smtpd logs some accepted and some (important) rejected SMTP session attempts.

Format: <server>: pid PID Action::Type::Condition: Information

In order to track a complete SMTP transaction (including tcpserver/sslserver + rblsmtpd) the log line includes the PID.

Caveats: Regarding ssslserver and its capabilities, not always the same PID is referenced in the logs for the same transaction.

• SNDR (S) corresponds to the sending MTA
• ORIG (F) is the "MAIL From: <Return-Path>"
• RCPT (T) is the "RCPT To: <Forwarding-Path>"
• DATA is the Message (content)
• SPF is Sender Policy Framework
• TLS denotes Transport Layer Security

The Information is typically constructed from the SMTP envelope like:

• S:IP:FQDN P:Protocol H:Helo F:Mailfrom T:Rcptto

This scheme is easy extendable to other successful/deferred SMTP sessions.

Sample for a successful qmail-smtpd session:

Sample for a rejected qmail-smtpd session:

Note 1: Again here, the entire mail transactions may not be found in one contiguous block but rather dispersed; however ordered in monotonically in time.

Note 2: Though the PID for a single transactions is preserved, given sslserver the last statement always shows the parent PID.

Note 3: Here, and in the other logging samples, sslserver is invoked for logging with the argument sslserver -V displaying the mod_ssl variables while showing the TLS Cipher Suite.

12.4 qmail-qmtpd

Starting with s/qmail 4.3 qmail-qmtpd does a minimal logging while acknowleding the received email. Together with sslserver the following log entries may be given in case of a successful transaction:

qmail-qmtpd will do a logging in the following failure cases:

• qmail-qmtpd: client does not talk QMTP
• qmail-qmtpd: Unacceptable sender (#5.1.7)
• qmail-qmtpd: Sorry, that message size exceeds my databytes limit (#5.3.4)
• qmail-qmtpd: Sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)

With s/qmail 4.3 some minimal logging is added:

• qmtpd: pid XXX done.
• qmtpd: pid XXX relayclient done.