TNPI - how do I watch the mail logs

home : internet : mail : toaster : upgrade : how do I watch the mail logs

Watching the log files

A good way to "see" problems and test your system is simply watching the logs in a second session while running the test script or sending some messages.

tail -F /var/log/maillog &

The contents of /var/log/maillog will be anything sent to syslog.mail. Typically this includes vpopmail authentications (pop3, smtp-auth, smtp-submission), courier authentications (imap, imap-ssl, sqwebmail), and SpamAssassin's logs.

tail -F /var/log/mail/send/current &

These are the qmail-send logs. These are where you want to look first if you're having mail delivery issues. Qmail logs all it's local and remote delivery logs to this one. This is one of the first places I start looking when you hire me to fix your server.

tail -F /var/log/mail/smtp/current &

These are the qmail-smtpd logs. By default, qmail-smtpd doesn't log anything. However, rblsmtpd and a few of our patches to qmail-smtpd do. In there you'll find all the blocked connections from rblsmtpd, any qregex rejections, chk-user rejections, and simscan rejections. Basically, you want to watch this guy if you are blocking something that you don't want to.

tail -F /var/log/mail/maildrop.log

Note that unless filtering_debug is enabled in toaster-watcher.conf, nothing will be written to maildrop.log. It is enabled by default, and changes only take effect after running "toaster_setup.pl -s maildrop".

Last modified on 4/8/05.