On Wed, Mar 09, 2011 at 01:17:38PM -0500, Wietse Venema wrote:
> Correct. With current Postfix implementations, there are two "marker"
> records that you can use:
>
> - The "postfix/qmgr .... removed" record that says the file is deleted.
> This record was introduced with Postfix version 2.1.
>
> - The "postfix/smtpd ... client=..." that says the file is created.
> This record is written by all Postfix versions. There is no
> equivalent record for mail that is submitted with the Postfix
> sendmail command. Instead use "postfix/cleanup .. message-id=..."
> which is also logged for SMTP mail.
In addition to qmqpd(8) logging message creation just like smtpd(8),
in fact pickup(8) also logs message creation:
2011-03-09T12:55:01-05:00 amnesiac postfix/pickup[25191]:
27D602FB86: uid=52009 from=<user>
Things get more interesting with "internally generated" messages, either
indirect forwarding by local(8) or sender/postmaster notifications from
((sufficiently recent Postfix) bounce(8):
2011-03-09T13:23:18-05:00 amnesiac postfix/bounce[11606]:
D55BD5049C4: sender non-delivery notification: BACC6504D20
these are logged after the cleanup(8) service logs the creation of
the message and instead correlate to the processing of the old and new
messages. These are not indicators that all previous instances of the
"new" queue-id are unrelated. So there is a theoretical possibility that
an smtpd(8) "client=..." log entry that goes with an aborted message
delivery will get incorrectly associated with a non-SMTP "internally
generated" message that reuses the queue id shortly after the aborted
transaction. In practice, this is a non-issue, and the presense of
bounce(8) or local(8) log entries can be used to pre-empt the association
of the most recent instance of the new queue-id with any exteral source.
--
Viktor.
