Plugin:Tail/Config

From collectd Wiki
< Plugin:Tail
Revision as of 20:50, 15 January 2010 by Tokkee (talk | contribs) (Postfix: rejected-spam_or_forged)

Jump to: navigation, search

This page contains some example configurations for the Tail plugin. This page is meant as a cookbook, so if you have a configuration for an aspect not handled here or a daemon not present, please feel free to add anything that's useful for you.

Exim

Exim is a mail transfer agent (MTA) which is the default mail server in Debian.

The example config collects the rate of incoming and outgoing messages, bounces, deferred messages, IP connections and messages handled by a specific “router”.

<File "/var/log/exim4/mainlog">
  Instance "exim"
  <Match>
    Regex "<="
    DSType "CounterInc"
    Type "email_type"
    Instance "incoming"
  </Match>
  <Match>
    Regex "=>"
    DSType "CounterInc"
    Type "email_type"
    Instance "outgoing"
  </Match>
  <Match>
    Regex "=="
    DSType "CounterInc"
    Type "email_type"
    Instance "defer"
  </Match>
  <Match>
    Regex "\\*\\*"
    DSType "CounterInc"
    Type "email_type"
    Instance "bounce"
  </Match>
  <Match>
    Regex "IP connection count = ([1-9][0-9]*)"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "connection_count"
  </Match>
  <Match>
    Regex "Spam_checked  Spam-Score: ([5-9]|[1-9][0-9])"
    DSType "CounterInc"
    Type "email_type"
    Instance "saspam"
  </Match>
  <Match>
    Regex "R=virtdomain"
    DSType "CounterInc"
    Type "email_type"
    Instance "router-virtdomain"
  </Match>
  <Match>
    Regex "R=smarthost"
    DSType "CounterInc"
    Type "email_type"
    Instance "router-smarthost"
  </Match>
  <Match>
    Regex "R=dnslookup"
    DSType "CounterInc"
    Type "email_type"
    Instance "router-dnslookup"
  </Match>
  <Match>
    Regex "R=system_aliases"
    DSType "CounterInc"
    Type "email_type"
    Instance "router-system_aliases"
  </Match>
  <Match>
    Regex "R=fail"
    DSType "CounterInc"
    Type "email_type"
    Instance "router-fail"
  </Match>
</File>

Postfix

Postfix is a mail transfer agent (MTA) which is widely used (e.g., used in large parts of the Debian infrastructure).

The example config collects the number of rejected messages, various status codes, messages size, and queue delay information.

mail_counter is defined as value:COUNTER:0:65535 (see types.db(5) for details) and is used instead of counter to prevent counter overflows when restarting collectd.

<File "/var/log/mail.log">
# or: <File "/srv/rsyslog/mail.log">
  Instance "postfix"

   # number of connections
   # (incoming)
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: connect from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-open"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: disconnect from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-close"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: lost connection after .* from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-lost"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: timeout after .* from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-timeout"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: setting up TLS connection from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-TLS-setup"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtpd\\[[0-9]+\\]: [A-Za-z]+ TLS connection established from\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-in-TLS-established"
   </Match>
   # (outgoing)
   <Match>
     Regex "\\<postfix\\/smtp\\[[0-9]+\\]: setting up TLS connection to\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-out-TLS-setup"
   </Match>
   <Match>
     Regex "\\<postfix\\/smtp\\[[0-9]+\\]: [A-Za-z]+ TLS connection established to\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "connection-out-TLS-established"
   </Match>

  # rejects for incoming E-mails
  <Match>
    Regex "\\<554 5\\.7\\.1\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "rejected"
  </Match>
  <Match>
    Regex "\\<450 4\\.7\\.1\\>.*Helo command rejected: Host not found\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "rejected-host_not_found"
  </Match>
  <Match>
    Regex "\\<450 4\\.7\\.1\\>.*Client host rejected: No DNS entries for your MTA, HELO and Domain\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "rejected-no_dns_entry"
  </Match>
   <Match>
     Regex "\\<450 4\\.7\\.1\\>.*Client host rejected: Mail appeared to be SPAM or forged\\>"
     DSType "CounterInc"
     Type "mail_counter"
     Instance "rejected-spam_or_forged"
   </Match>

  # status codes
  <Match>
    Regex "status=deferred"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-deferred"
  </Match>
  <Match>
    Regex "status=forwarded"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-forwarded"
  </Match>
  <Match>
    Regex "status=reject"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-reject"
  </Match>
  <Match>
    Regex "status=sent"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-sent"
  </Match>
  <Match>
    Regex "status=bounced"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-bounced"
  </Match>
  <Match>
    Regex "status=SOFTBOUNCE"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "status-softbounce"
  </Match>

  # message size
  <Match>
    Regex "size=([0-9]*)"
    DSType "CounterAdd"
    Type "ipt_bytes"
    Instance "size"
  </Match>

  # delays (see [1] for details)
  # total time spent in the Postfix queue
  <Match>
    Regex "delay=([\.0-9]*)"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay"
  </Match>
  # time spent before the queue manager, including message transmission
  <Match>
    Regex "delays=([\.0-9]*)/[\.0-9]*/[\.0-9]*/[\.0-9]*"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-before_queue_mgr"
  </Match>
  # time spent in the queue manager
  <Match>
    Regex "delays=[\.0-9]*/([\.0-9]*)/[\.0-9]*/[\.0-9]*"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-in_queue_mgr"
  </Match>
  # connection setup time including DNS, HELO and TLS
  <Match>
    Regex "delays=[\.0-9]*/[\.0-9]*/([\.0-9]*)/[\.0-9]*"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-setup_time"
  </Match>
  # message transmission time
  <Match>
    Regex "delays=[\.0-9]*/[\.0-9]*/[\.0-9]*/([\.0-9]*)"
    DSType "GaugeAverage"
    Type "gauge"
    Instance "delay-trans_time"
  </Match>
</File>

policyd-weight

policyd-weight is a policy daemon for the Postfix MTA.

The example config collects the number of messages rated unknown, accepted, deferred, and rejected.

<File "/var/log/mail.log">
  Instance "policyd_weight"
  <Match>
    Regex "policyd-weight.*action=DUNNO\\>"
    DSType "CounterInc"  
    Type "mail_counter"  
    Instance "unknown"
  </Match>

  <Match>
    Regex "policyd-weight.*action=PREPEND\\>"
    DSType "CounterInc"  
    Type "mail_counter"  
    Instance "accepted"
  </Match>

  <Match>
    Regex "policyd-weight.*action=450\\>"
    DSType "CounterInc"  
    Type "mail_counter"  
    Instance "deferred"
  </Match>

  <Match>
    Regex "policyd-weight.*action=550\\>"
    DSType "CounterInc"  
    Type "mail_counter"  
    Instance "rejected"
  </Match>
</File>

Postgrey

Postgrey is a Postfix policy server.

The sample config collects the number of messages that were greylisted, accepted (by the greylist), and accepted by whitelist.

<File "/var/log/mail.log">
  Instance "postgrey"
  <Match>
    Regex "\\<action=greylist, reason=new\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "greylisted"
  </Match>
 
  <Match>
    Regex "\\<action=pass, reason=triplet found\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "accepted"
  </Match>
 
  <Match>
    Regex "\\<action=pass, reason=client whitelist\\>"
    DSType "CounterInc"
    Type "mail_counter"
    Instance "client_whitelist"
  </Match>
</File>

See also