March 2009
Many log analyzers are listed at loganalysis.org.
Lire is one such log analyzer.
It can be set up in such a way that other machines send their logs for analysis to a machine that has Lire watch incoming mail, the so called responder
, and it mails the analysis to the admin.
We followed the responder installation manual using Ubuntu Jaunty
, PostFix
, and fetchmail
.
First, configure PostFix it as a satellite system with a smarthost.
You can use dpkg-reconfigure postfix to re-run the configuration process if you haven't already configured it like that in the previous step.
Add the following line to /etc/postfix/main.cf
to enable maildir
-style mailboxes:
mail_spool_directory = /var/mail/
Then restart postfix: sudo /etc/init.d/postfix/restart
Also (standard good practice) edit /etc/aliases
to send root mail to a real person.
While you're at it, create a couple of maildirs 'accounts' in /etc/aliases
too:
apache2: /var/spool/lire/apache2/Maildir/ postfix: /var/spool/lire/postfix/Maildir/
Don't forget to run postalias on that file.
Now also create the maildirs, and give ownership to nobody
, the user as which Postfix delivers mail.
![]() | Warning |
---|---|
ToDo: create an actual system account especially for this |
sudo mkdir -p /var/spool/lire/{postfix,apache2}/Maildir/{tmp,new,cur}
sudo chown -R nobody /var/spool/lire/*
Now send a mail from a local account and see whether PostFix delivers it below /var/spool/lire/apache2/
.
If not, tail /var/log/mail.log
for hints.
echo "blah"|mailx -s test2 apache2@localhost
find /var/spool/lire/
/var/spool/lire/apache2/
/var/spool/lire/apache2/cur
/var/spool/lire/apache2/tmp
/var/spool/lire/apache2/new
/var/spool/lire/apache2/new/1236899044.V808I238b2M333495.cit-zb-13-81
After a while, this shows up in /var/log/mail.log
:
all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/dbmail/Maildir/new/
all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/watchguard/Maildir/new/
all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/iis_ftp/Maildir/new/
all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/cups_pagelog/Maildir/new/
bogus message: Can't locate package Exporter for @Lire::Config::Build::ISA at /usr/share/perl5/Lire/Config.pm line 7.
bogus message: Undefined subroutine &Lire::Config::ac_info called at /usr/share/perl5/Lire/Config.pm line 50.
bogus message: BEGIN failed--compilation aborted at /usr/share/perl5/Lire/Program.pm line 174.
bogus message: Compilation failed in require at /usr/share/lire/lib/lire/lr_getbody line 10.
bogus message: BEGIN failed--compilation aborted at /usr/share/lire/lib/lire/lr_getbody line 10.
all postfix lr_tag-20090313070738-22471 lr_processmail warning lr_getbody didn't completed successfully
all postfix lr_tag-20090313070738-22471 lr_processmail err No submitter can be found. Keeping /tmp/lr_processmail.postfix.lr_tag-20090313070738-22471.nvBgom.mail for debugging
all all lr_tag-20090313070738-22471 lr_spool err lr_processmail postfix on file '/tmp/1236924314.V808I238b4M604047.cit-zb-39-54' failed, moving to /var/lib/lire/data/email/raw/failed
bogus message: mv: cannot move `/tmp/1236924314.V808I238b4M604047.cit-zb-39-54' to `/var/lib/lire/data/email/raw/failed': No such file or directory
Start the responder manually: sudo lr_run lr_spoold& (Later on, we're going to create an initscript for this).
Send the local postfix log to the analyzer to see if it reacts: cat /var/log/mail.log |mailx -s postfix-analysis-test postfix@localhost
![]() | Note |
---|---|
The log analyzer is a cron kind of thing, so reactionmay not be immediate. Be patient. |
![]() | Note |
---|---|
Whether the results show up in your mailbox on the system on the system at hand or somewhere else of course depends on whether you properly configured an alias for yourself. |