Victor Duchovni:
> On Wed, Mar 09, 2011 at 01:17:38PM -0500, Wietse Venema wrote:
>
> > Correct. With current Postfix implementations, there are two "marker"
> > records that you can use:
> >
> > - The "postfix/qmgr .... removed" record that says the file is deleted.
> > This record was introduced with Postfix version 2.1.
> >
> > - The "postfix/smtpd ... client=..." that says the file is created.
> > This record is written by all Postfix versions. There is no
> > equivalent record for mail that is submitted with the Postfix
> > sendmail command. Instead use "postfix/cleanup .. message-id=..."
> > which is also logged for SMTP mail.
>
> In addition to qmqpd(8) logging message creation just like smtpd(8),
> in fact pickup(8) also logs message creation:
>
> 2011-03-09T12:55:01-05:00 amnesiac postfix/pickup[25191]:
> 27D602FB86: uid=52009 from=<user>
>
> Things get more interesting with "internally generated" messages, either
> indirect forwarding by local(8) or sender/postmaster notifications from
> ((sufficiently recent Postfix) bounce(8):
>
> 2011-03-09T13:23:18-05:00 amnesiac postfix/bounce[11606]:
> D55BD5049C4: sender non-delivery notification: BACC6504D20
>
> these are logged after the cleanup(8) service logs the creation of
> the message and instead correlate to the processing of the old and new
> messages. These are not indicators that all previous instances of the
> "new" queue-id are unrelated. So there is a theoretical possibility that
> an smtpd(8) "client=..." log entry that goes with an aborted message
> delivery will get incorrectly associated with a non-SMTP "internally
> generated" message that reuses the queue id shortly after the aborted
> transaction. In practice, this is a non-issue, and the presense of
> bounce(8) or local(8) log entries can be used to pre-empt the association
> of the most recent instance of the new queue-id with any exteral source.
Perhaps it is time to replace the time-in-microseconds portion of
the queue ID by a sufficient number of random bits.
Wietse
