the djb way

you've got spam!

multilogging rblsmtpd

So far the rblsmtpd-protected qmail-smtpd service is still set up with the usual multilog "run" script, that is:

# qmail-smtpd/log/run
# daemontools multilogger for qmail-smtpd
# ===
exec setuidgid multilog multilog t /var/multilog/qmail-smtpd \

### that's all, folks!

This directs all logging output to the directory /var/multilog/qmail-smtpd. Pretty soon, though, as spammers are blocked by the rblsmtpd utility, the logs will start showing lines like these:

$ cd /var/multilog/qmail-smtpd
$ tail current | tai64nlocal
2004-09-24 10:20:53.411980500 tcpserver: status: 1/49
2004-09-24 10:20:53.414696500 tcpserver: pid 19288 from
2004-09-24 10:20:53.424020500 tcpserver: ok 19288 :
2004-09-24 10:20:54.071190500 rblsmtpd: pid 19288: 451
2004-09-24 10:20:57.846226500 tcpserver: end 19288 status 0
2004-09-24 10:20:57.846482500 tcpserver: status: 0/49

The fourth line in the sample output above shows a message from rblsmtpd as it blocks mail from the connection.

To get at just the rblsmtpd entries in the logs, the log files may simply be grep'ed periodically:

$ cat current |tai64nlocal |grep rblsmtpd
2004-09-24 10:20:54.071190500 rblsmtpd: pid 19288: 451

On the other hand, if you are interested in keeping a regular eye on rblsmtpd activity, this service makes a good case for using more of the capabilities of multilog.

First, make a copy of the original "run" script and open it in your editor:

# cd /service/qmail-smtpd/log
# cp run
# vim

Modify the file "" to look like this:

# qmail-smtpd/log/run
# daemontools multilogger for qmail-smtpd
#   + separate log for rblsmtpd
# ===
exec setuidgid multilog multilog t \
    /var/multilog/qmail-smtpd \
    '-*'  '+* rblsmtpd: *'  /var/multilog/rblsmtpd

### that's all, folks!

The addition to this file includes the following new actions in the multilog "script":

'-*' first, deselect all lines
'+* rblsmtpd: *' then, select just the lines which include the string "rblsmtpd:"
/var/multilog/rblsmtpd now, maintain logs of these lines in the specified directory

Set up the new log directory to capture just the rblsmtpd output:

# mkdir /var/multilog/rblsmtpd
# chown multilog /var/multilog/rblsmtpd

Ready to go? Move the new multilogger into position and restart the qmail-smtpd service:

# cd /service/qmail-smtpd/log
# mv run
# cd ..
# svc -d . ./log; svc -u ./log .

All the lines recorded by the qmail-smtpd service will continue to appear in /var/multilog/qmail-smtpd as before. But now you will also have just the rblsmtpd messages, maintained in their own separate multilog directory, /var/multilog/rblsmtpd.

Copyright © 2003, 2004, Wayne Marshall.
All rights reserved.

Last edit 2004.09.30, wcm.