amavis-user March 2012 archive
Main Archive Page > Month Archives  > amavis-user archives
amavis-user: Re: Logging question

Re: Logging question

From: Henrik K <hege_at_nospam>
Date: Thu Mar 29 2012 - 08:27:52 GMT
To: amavis-users@amavis.org

On Thu, Mar 29, 2012 at 09:25:50AM +0200, Ralf Hildebrandt wrote:
> Mar 29 09:13:20 mail2 amavis[16916]: (16916-16) Passed CLEAN {RelayedOutbound}, LOCAL [141.42.206.36]:37952 [85.179.68.181]
> <absender@charite.de> -> <empfaenger@gmail.com>, Message-ID: <86e7921583186ccc7b08fa356655af14.squirrel@webmail.charite.de>,
> mail_id: hK-6Jq4eATvE, Hits: -2.14, size: 3977, queued_as: 3VJHHN5wKjz1tJd, dkim_new=default:charite.de, 538 ms
>
> [141.42.206.36]:37952 is my mailserver, but what is 85.179.68.181?
>
> Under which circumstance does amavis log 2 IPs in [] and what info is
> being logged there?

Well it's all there if you look for it..

# This text section governs how a main per-message amavisd-new log entry (at
# log level 0) is formed (config variable $log_short_templ). Empty disables it.
[?%#D|#|Passed #
[? [:ccat|major] |#
OTHER|CLEAN|MTA-BLOCKED|OVERSIZED|BAD-HEADER-[:ccat|minor]|SPAMMY|SPAM|\
UNCHECKED|BANNED (%F)|INFECTED (%V)] {[:actions_performed]}#
, [? %p ||%p ][?%a||[?%l||LOCAL ][:client_addr_port] ][?%e||\[%e\] ]%s -> [%D|,]#
...

http://www.ijs.si/software/amavisd/README.customize.txt
  e best guess of the originator IP address collected from the Received trace