Web Hosting Talk : Web Hosting Main Forums : Programming Discussion : is there anyway that I can extracting smtp traffic from logs

[kustomjs]

Hi Guys
I am just wondering if there is anyway that I could extracting smtp traffic from per user with logs and put into like a mysql database? because my setup is with postfix+dovecot+mysql

like this:

outbound
May 20 22:13:37 mail sm-mta[47291]: n4L2DaNl047291 from=<xxxxx@domain.net>, size=1370, class=0, nrcpts=1, msgid=<E2E640AC5BCD49DF8FC380DFAE2F4670@xxxxx>, proto=SMTP, daemon=IPv4, relay=xxx.xxx.xxx.xxx[xxx.xxx.xxx.xxx]

incoming
May 20 00:32:47 mail sm-mta[49233]: n4K4Wkeg049233 from=<1-8100100-domain.net?xxxxx@mxx.xxx.com>, size=0, class=0, nrcpts=1, proto=SMTP, daemon=IPv4, relay=xxxxx1.*********** [xx.xx.x.xxx]

dovecot pop3/imap
May 20 22:10:00 mail dovecot: POP3(xxxx): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0

[kustomjs]

Ok tell me after 26 views and no replys what is up with that?

[oldunis]

Originally Posted by kustomjs

Ok tell me after 26 views and no replys what is up with that?

Maybe being a little bit more polite could help

I see two options:
1- You make up a script that parses through dovecot's log. Since it is a standard log file, it should not be too hard.
2- For the inboud, it is possible to forward the emails to a script. Just like with most support ticket system...

[UNIXy]

For SMTP, create a content filter in master.cf for smtp/smtps (-o content_filter=transactlog:transactlog)

transactlog unix - n n - - pipe
flags=Rq user=transactlog argv=/usr/local/bin/transactlog -f ${sender} -- ${recipient}

transactlog can be a perl / php script that connects to the DB and or dumps the data to a file.

For dovecot, just add an SQL update in the same dovecot mysql conf file (%n = username %d = domain).

Edit: Be sure to set the right Exit code in the transactlog script

Regards