Logwatch, add a new postfix custom service

Jun 08, 2014

Last days ago I had lot of problems with MTA servers, hacked accounts, bad redirects policies and some other minor issues that kept me with the hands dirty in sysadmin keyboard. Needless to say how I love to put my sysadm hat and start to fix and/or optimize stuff, so from that bunch of problems was born this little script that makes my days easier than before.

We're talking about a logwatch custom service. Logwatch is a customizable log analysis system. Logwatch parses through your system's logs and creates a report analyzing areas that you specify. Logwatch is easy to use and will work right out of the package on most systems. I use logwatch to monitor common services running on servers. It sends me a daily report by mail telling me what happened last 24 hours. It's easy to add a new custom service, you have to put 3 files in the right place (Debian like distribution):

/etc/logwatch/conf/logfiles/my-postfix.conf - Log configuration, the log files path and other minor options.
/etc/logwatch/conf/services/my-postfix.conf - Service configuration, the title and the log file group we want to "inspect" (usually related to the above point).
/etc/logwatch/scripts/services/my-postfix - The script that executes the command with the proper output you want to add in logwatch's report.

/etc/logwatch/conf/logfiles/my-postfix.conf

# /etc/logwatch/conf/logfiles/my-postfix.conf

# The LogFile path is relative to /var/log by default.
# You can change the default by setting LogDir.
LogFile = mail*.log

# This enables searching through zipped archives as well.
Archive = mail*.gz

# Expand the repeats (actually just removes them now).
*ExpandRepeats

/etc/logwatch/conf/services/my-postfix.conf

# /etc/logwatch/conf/services/my-postfix.conf

# The title shown in the report.
Title = "My Postfix"

# The name of the log file group (file name).
LogFile = my-postfix

/etc/logwatch/scripts/services/my-postfix

!/usr/bin/env bash
# /etc/logwatch/scripts/services/my-postfix

mailq | grep @ | awk '{ORS=(ORS==RS)?FS:RS; print $$NF}'
tot=`mailq | grep @ | awk '{ORS=(ORS==RS)?FS:RS; print $$NF}' | wc -l`

echo -e ""
echo "Total: ${tot}"
echo -e ""
echo -e ""
echo -e "Deferred emails from mail.log"
echo -e ""
grep "status" | grep -v "status=sent" | awk '{print $7" "$12}' | sort -rn | uniq -c | sort -rn

The output

This is the report that the script sends me in the email, first part are the queued emails and the second part is a deferred list sorted by number of times it appears on mail.log:

--------------------- My Postfix Begin ------------------------

 8A183B59       4347 Fri Jun  6 01:11:31  xxx@gmail.com -> zzz@gmail.com
 88EE3B7C       2501 Thu Jun  5 16:28:42  xxx@domain.com -> xxx@terra.es
 E16C1B3C        435 Thu Jun  5 13:34:28  xxx@xxx.kimsufi.com -> root@xxx.kimsufi.com
 A4F3CB78       2501 Thu Jun  5 15:09:41  xxx@domain.com -> zzz@terra.es
 AE0DBB8F       2501 Thu Jun  5 18:38:00  xxx@domain.com -> zzz@terra.es
 AB746B6E       2501 Thu Jun  5 14:17:22  xxx@domain.com -> zzz@terra.es
 AB5A289A        807 Wed Jun  4 06:26:47  xxx@xxx.kimsufi.com -> root@xxx.kimsufi.com

 Total: 7

 Deferred emails from mail.log

     484 to=(root@xxxx.kimsufi.com), dsn=4.3.0,
     461 to=(zzz@terra.es), status=deferred
     170 to=(root@yyy.kimsufi.com), status=deferred
      56 to=(info@domain.com), status=deferred
      37 to=(zzz@gmail.com), dsn=4.7.0,
      31 to=(ooo@gmail.es), status=deferred
      31 to=(vvv@terra.es), status=deferred
      ...
       1 from=(soporte@domain.com),
       1 from=(root@vvv.kimsufi.com),

 ---------------------- My Postfix End -------------------------

The main goal is to be able to take some decisions with a simple and quick glance.

Recomendations

As you can see in the last script, the bunch of files we selected to inspect (mail*.log) was the main input of the script, so we don't need to make a cat or something like that in the service script, they're treated as STDIN.

I must say too that you must activate logrotate on the logs to preserve logwatch eating cpu and harddisk for a long time. You can read more about how to add a service in logwatch here.