Arch Linux

blacktav

Member

From: Alloue, France

Registered: 2012-04-14

Posts: 11

journalctl filter for postfix logging

Hi

I am looking for a sensible filter for journalctl that will give me postfix activity

journalctl -u postfix

just gives this output like this

-- Logs begin at Sat 2019-05-04 05:57:29 CEST, end at Tue 2019-06-25 13:01:11 CEST. --
May 12 11:24:06 folkvanger systemd[1]: Starting Postfix Mail Transport Agent...
May 12 11:24:06 folkvanger systemd[1]: Started Postfix Mail Transport Agent.
May 12 13:32:59 folkvanger systemd[1]: Stopped Postfix Mail Transport Agent.
May 12 13:32:59 folkvanger systemd[1]: Stopping Postfix Mail Transport Agent...

I want to see all the logging traffic such as this

Jun 25 13:05:25 folkvanger postfix/qmgr[20330]: 1232460419A6: removed
Jun 25 13:05:25 folkvanger postfix/smtp[26375]: 1232460419A6: to=<blacktav@gmail.com>, relay=gmail-smtp-in.l.google.com[64.233.184.26
Jun 25 13:05:25 folkvanger postfix/qmgr[20330]: 1232460419A6: from=<root@folkvanger>, size=352, nrcpt=1 (queue active)
Jun 25 13:05:25 folkvanger postfix/cleanup[26374]: 1232460419A6: message-id=<20190625110525.1232460419A6>
Jun 25 13:05:25 folkvanger postfix/pickup[15302]: 1232460419A6: uid=0 from=<root@folkvanger>
Jun 25 13:01:54 folkvanger postfix/smtpd[24299]: disconnect from unknown[172.17.0.3] ehlo=1 mail=2 rcpt=0/2 data=0/2 rset=3 commands=
Jun 25 13:01:54 folkvanger postfix/smtpd[24310]: disconnect from unknown[172.17.0.3] ehlo=1 mail=2 rcpt=0/2 data=0/2 rset=3 commands=
Jun 25 13:01:54 folkvanger postfix/smtpd[24310]: lost connection after RSET from unknown[172.17.0.3]
Jun 25 13:01:54 folkvanger postfix/smtpd[24299]: warning: smtpd_client_event_limit_exceptions: non-null host address bits in "172.17.
Jun 25 13:01:54 folkvanger postfix/smtpd[24310]: warning: smtpd_client_event_limit_exceptions: non-null host address bits in "172.17.

Thanks

---

Mack

snakeroot

Member

Registered: 2012-10-06

Posts: 177

Re: journalctl filter for postfix logging

Does journalctl -g postfix do what you want?

From man journalctl:

-g, --grep=
           Filter output to entries where the MESSAGE= field matches the specified regular expression.
           PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description
           of the syntax.

           If the pattern is all lowercase, matching is case insensitive. Otherwise, matching is case
           sensitive. This can be overridden with the --case-sensitive option, see below.

blacktav

Member

From: Alloue, France

Registered: 2012-04-14

Posts: 11

Re: journalctl filter for postfix logging

Thanks for the reply

-g is better than nothing but the grep is performed on the whole text-line as far as I can see
with the result that a lot of irrelevant stuff gets included and it takes a while to process

it might actually just be grepping the "message" text rather than the unit or service which would be not very helpful at all; but I cannot confirm that

After some experimentation, discovered the answer to be

journalctl -u postfix*

Rather obvious unfortunately

---

Mack

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,423

Re: journalctl filter for postfix logging

Glad to hear, can you mark as [SOLVED] by editing and appending to the title in your first post?