mail log

[nateb0t]

I'm wanting to use AWstats to process my mail and ftp logs.
I just need to know the paths to the logs.

[Chris]

I'm wanting to use AWstats to process my mail and ftp logs.
I just need to know the paths to the logs.

Hey nateb0t,

You need to do a couple of things to create these logs.

First, turn on FTP logging, by following the instructions in this article.
http://help.hardhathosting.com/question.php/177

Once you make the above changes, FTP to your account and transfer a file. You should now see the FTP log here:

/var/log/xferlog

Second, you need to make a change to your sendmail configuration.

You need to edit the /etc/mail/sendmail.cf file. Find these lines:

# log level
O LogLevel=0
change them to this:

# log level
O LogLevel=9
After saving the file, run this command from the command-line:

newaliases

You should now see your maillog here:

/var/log/maillog

IMPORTANT: Do NOT save the above config files with a DOS editor, i.e. MS Notepad or Wordpad. You need to use either VI or PICO on the server, or something similar to UltraEdit on your PC. Do NOT save the files in DOS.

[nateb0t]

ok all good so far. but I'm beating my brain trying to figure out the log format:

Tue Jul 13 01:29:00 2004 1 cust-216-9-157-159.bton.kiva.net 542 /var/www/html/footer-inc.php a _ i r webthrall ftp 0 * c


%other %time3 %other %host %bytesd %ur %other %other %other %method %user %other %code %other %other

but I end up with corrupted records for 7001 lines out of 13293 parsed.

Corrupted record (invalid date, timerecord=202700454500): Mon Sep 27 20:45:45 2004 1 ra.infohell.net 7407 /var/www/html/forums/uploads/post-8-1071915650.ibf b _ o r forum-admin ftp 0 * c


Which *might* be due to the format, but if I remove the leading "%other" it won't accept the format at all, so something is wrong with the date itself?

AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
Your log file /var/log/xferlog must have a bad format or LogFormat parameter setup does not match this format.


any ideas?

[Chris]

Sorry nateb0t...I don't have a clue. I would hit Google up for some answers. :)

[nateb0t]

ya i was afraid of that. Looks like the way the ftp and mail logs are written AWstats isn't able to read them. There just aren't consistant enough pattern especially the mail logs that seem to have different data and different amounts each line. Guess I just gotta eyeball the logs myself.