Recommend a maillog analyzer

April 14, 2009 2:21 PM

Recommend me a good sendmail log analyzer.

We had a recent event where one of two servers running sendmail stopped sending mail, and built up a 7000 message queue before we noticed / fixed it. It's fixed now, but we don't know why it failed, and this part of the system is important but clearly neglected.

Can anyone recommend a good tool similar to Google Analytics or apache log analyzers, but for sendmail?

Bonus question: How big should a mail queue be before nagios should throw a warning or error?

posted by pwnguin to computers & internet (3 comments total)

Setup cacti to talk to snmpd and chart your sendmail queue. Setup nagios to warn once you hit 105% of your peak e-mail queue size, error at 125% - then adjust to remove false alarms.

For servers that I admin I have a Nagios check that sends e-mail to an external address which sends an automated reply. I look at how long it takes to come back. More than 30 seconds is unusual, so I warn at a minute and error at five. But it depends how often your nagios check is running.

Can anyone recommend a good tool similar to Google Analytics or apache log analyzers, but for sendmail?

Do you still need this part answered? What do you want to be able to do with this? I think awstats would do it.
posted by devnull at 2:26 PM on April 14 [1 favorite has favorites]

Ideally, it'd warn about top domains that refuse delivery, chart daily volume of mail, and other stuff. We're starting from a very big knowledge deficit here, so I think something other people built would at least give us a hint about the kinds of important things to look out for.
posted by pwnguin at 2:48 PM on April 14

The postfix equivalent of what you want is "pflogsumm", if that gives you a Google starting point. Unfortunately the obvious "pflogsumm for sendmail" gives five hits, all of which are someone asking the same question.

(That said, there seem to be a lot of useful hits for "sendmail log analyzer", if you hadn't tried that. I can't recommend one from experience, I don't use sendmail. I've heard good things about Anteater though.)
posted by mendel at 8:17 PM on April 14