qmail log问题讨论

netocool

我的qmail系统的日志输出目录情况：
[root@mail qmail]# pwd
/var/log/qmail
[root@mail qmail]# ls
pop3   send  smtp  spamd
[root@mail qmail]#

qmail日志产生办法：
[root@mail send]# pwd
/var/qmail/supervise/send/log
[root@mail log]# vim run

[Copy to clipboard] [ - ]
CODE:
#!/bin/sh
LOGSIZE=`cat /var/qmail/control/logsize`
LOGCOUNT=`cat /var/qmail/control/logcount`
exec /usr/bin/setuidgid qmaill /usr/bin/multilog t s$LOGSIZE n$LOGCOUNT /var/log/qmail/send 2>&1


[root@mail log]# pwd
/var/qmail/supervise/smtp/log
[root@mail log]# vim run

[Copy to clipboard] [ - ]
CODE:
#!/bin/sh
LOGSIZE=`cat /var/qmail/control/logsize`
LOGCOUNT=`cat /var/qmail/control/logcount`
exec /usr/bin/setuidgid qmaill /usr/bin/multilog t s$LOGSIZE n$LOGCOUNT /var/log/qmail/smtp 2>&1


[root@mail log]# pwd
/var/qmail/supervise/pop3/log
[root@mail log]# vim run

[Copy to clipboard] [ - ]
CODE:
#!/bin/sh
LOGSIZE=`cat /var/qmail/control/logsize`
LOGCOUNT=`cat /var/qmail/control/logcount`
exec /usr/bin/setuidgid qmaill /usr/bin/multilog t s$LOGSIZE n$LOGCOUNT /var/log/qmail/pop3 2>&1


目前查看qmail日志办法：
[root@mail send]# pwd
/var/log/qmail/send
[root@mail send]# tai64nlocal < current

[Copy to clipboard] [ - ]
CODE:
2008-07-31 00:20:31.685348500 info msg 1803366: bytes 66308 from <dandma@ert.cn> qp 22129 uid 100
2008-07-31 00:20:31.690076500 starting delivery 1189: msg 1803366 to local ericlu@ert.cn[/email]
2008-07-31 00:20:31.690082500 status: local 1/10 remote 0/60
2008-07-31 00:20:31.717134500 delivery 1189: success: did_0+0+1/
2008-07-31 00:20:31.717140500 status: local 0/10 remote 0/60
2008-07-31 00:20:31.717144500 end msg 1803366
2008-07-31 00:22:33.481513500 new msg 1803366
2008-07-31 00:22:33.481519500 info msg 1803366: bytes 66308 from <danima@ert.cn> qp 22156 uid 100
2008-07-31 00:22:33.486874500 starting delivery 1190: msg 1803366 to local erick@ert.cn[/email]
2008-07-31 00:22:33.486880500 status: local 1/10 remote 0/60
2008-07-31 00:22:33.513754500 delivery 1190: success: did_0+0+1/
2008-07-31 00:22:33.513760500 status: local 0/10 remote 0/60
2008-07-31 00:22:33.513764500 end msg 1803366
2008-07-31 00:23:07.260318500 new msg 1803366
2008-07-31 00:23:07.260463500 info msg 1803366: bytes 66308 from <ddya@ert.cn> qp 22174 uid 100
2008-07-31 00:23:07.265329500 starting delivery 1191: msg 1803366 to local erick@21cn.com[/email]
2008-07-31 00:23:07.265335500 status: local 1/10 remote 0/60
2008-07-31 00:23:07.291470500 delivery 1191: success: did_0+0+1/
2008-07-31 00:23:07.291476500 status: local 0/10 remote 0/60
2008-07-31 00:23:07.291480500 end msg 1803366
2008-07-31 00:23:46.309774500 new msg 1803366
2008-07-31 00:23:46.309780500 info msg 1803366: bytes 66308 from <dkia@ert.cn> qp 22192 uid 100
2008-07-31 00:23:46.314368500 starting delivery 1192: msg 1803366 to local deyliu@yahoo.cn[/email]
2008-07-31 00:23:46.314374500 status: local 1/10 remote 0/60


查看到的邮件收发信息是比较详细的，但是查看qmail的smtp和pop3信息就不尽人意：

[root@mail smtp]# pwd
/var/log/qmail/smtp
[root@mail smtp]# tai64nlocal < current

[Copy to clipboard] [ - ]
CODE:
2008-08-22 12:26:40.723181500 tcpserver: status: 0/100
2008-08-22 12:39:37.515143500 tcpserver: status: 1/100
2008-08-22 12:39:37.515150500 tcpserver: pid 24898 from 218.102.53.13
2008-08-22 12:39:37.515155500 tcpserver: ok 24898 mail.ert.cn:10.0.2.10:25 :218.102.53.13::54773
2008-08-22 12:39:41.203366500 tcpserver: end 24898 status 0
2008-08-22 12:39:41.203372500 tcpserver: status: 0/100
2008-08-22 12:49:20.407437500 tcpserver: status: 1/100
2008-08-22 12:49:20.409141500 tcpserver: pid 24921 from 218.102.53.13
2008-08-22 12:49:20.409146500 tcpserver: ok 24921 mail.ert.cn:10.0.2.10:25 :218.102.53.13::55484
2008-08-22 12:49:21.001666500 tcpserver: end 24921 status 0
2008-08-22 12:49:21.001672500 tcpserver: status: 0/100
2008-08-22 13:19:09.034146500 tcpserver: status: 1/100
2008-08-22 13:19:09.034170500 tcpserver: pid 25022 from 116.25.131.72
2008-08-22 13:19:09.034175500 tcpserver: ok 25022 mail.ert.cn:10.0.2.10:25 :116.25.131.72::4303
2008-08-22 13:19:10.235852500 tcpserver: end 25022 status 0
2008-08-22 13:19:10.235857500 tcpserver: status: 0/100


qmail的smtp日志只记录smtp连接的IP地址和时间
pid是什么意思呢？例如2008-08-22 12:49:20.409141500 tcpserver: pid 24921 from 218.102.53.13，进来一个邮件

但是如何才能够在qmail的send日志中找到这个邮件的详细信息呢？是什么邮件地址发过来的呢？发给谁呢？

[root@mail pop3]# pwd
/var/log/qmail/pop3
[root@mail pop3]# tai64nlocal < current

[Copy to clipboard] [ - ]
CODE:
2008-09-01 19:42:50.218745500 tcpserver: status: 0/100
2008-09-01 19:42:51.107977500 tcpserver: status: 1/100
2008-09-01 19:42:51.107983500 tcpserver: pid 20404 from 219.136.166.8
2008-09-01 19:42:51.107987500 tcpserver: ok 20404 0:10.0.2.10:110 :219.136.166.8::61607
2008-09-01 19:42:53.039149500 tcpserver: end 20404 status 256
2008-09-01 19:42:53.039154500 tcpserver: status: 0/100
2008-09-01 19:47:54.987821500 tcpserver: status: 1/100
2008-09-01 19:47:54.987829500 tcpserver: pid 20413 from 219.136.166.8
2008-09-01 19:47:54.987834500 tcpserver: ok 20413 0:10.0.2.10:110 :219.136.166.8::61617
2008-09-01 19:47:56.382481500 tcpserver: end 20413 status 256
2008-09-01 19:47:56.382487500 tcpserver: status: 0/100
2008-09-01 19:47:57.021153500 tcpserver: status: 1/100
2008-09-01 19:47:57.021159500 tcpserver: pid 20416 from 219.136.166.8
2008-09-01 19:47:57.021163500 tcpserver: ok 20416 0:10.0.2.10:110 :219.136.166.8::61619
2008-09-01 19:47:59.138800500 tcpserver: end 20416 status 256
2008-09-01 19:47:59.138806500 tcpserver: status: 0/100
2008-09-01 19:53:01.149828500 tcpserver: status: 1/100
2008-09-01 19:53:01.149850500 tcpserver: pid 20423 from 219.136.166.8
2008-09-01 19:53:01.149855500 tcpserver: ok 20423 0:10.0.2.10:110 :219.136.166.8::61631
2008-09-01 19:53:02.436220500 tcpserver: end 20423 status 256
2008-09-01 19:53:02.436226500 tcpserver: status: 0/100
2008-09-01 19:53:03.095537500 tcpserver: status: 1/100
2008-09-01 19:53:03.096935500 tcpserver: pid 20426 from 219.136.166.8
2008-09-01 19:53:03.096940500 tcpserver: ok 20426 0:10.0.2.10:110 :219.136.166.8::61633
2008-09-01 19:53:04.351779500 tcpserver: end 20426 status 256
2008-09-01 19:53:04.351785500 tcpserver: status: 0/100
2008-09-01 19:53:31.292338500 tcpserver: status: 1/100
2008-09-01 19:53:31.292343500 tcpserver: pid 20429 from 125.215.224.193
2008-09-01 19:53:31.292348500 tcpserver: ok 20429 0:10.0.2.10:110 :125.215.224.193::32943
2008-09-01 19:54:05.816009500 tcpserver: end 20429 status 256
2008-09-01 19:54:05.816015500 tcpserver: status: 0/100
2008-09-01 19:54:06.513117500 tcpserver: status: 1/100


pop3的日志也只有连接的时间和IP信息

但是目前我想需要更多的信息，例如:2008-09-01 19:53:03.096935500 tcpserver: pid 20426 from 219.136.166.8
有一用户连接到qmail收邮件，我想知道是哪个用户（邮件地址），他本次收的邮件的大小是多大呢？


大家有什么好的建议呢？谢谢