Pflogsumm Metalog Howto

If you're looking to get Pflogsumm working with metalog the solution is close at hand with a minor source code modification.

Synopsis

Pflogsumm by James S. Seymour is a Perl script to analyse postfix mail logs and provides an overview of the MTA's activity. Unfortunately it does not work with metalog generated postfix mail logs and the author appears to be unwilling to address this minor shortcoming as noted in the authors FAQ.

The reason Pflogsumm cannot extrapolate results from metalog generated logs is simple, it's not in the syslog standard data format Pflogsumm expects. Based on this premiss, a simple problem requires a simple solution, and that solution is a one line source code regex mung to provide Pflogsumm with the syslog standard format it expects if the metalog format is observed in the input stream.

Implementation

In the main while loop at or around line 542 623 in the pflogsumm.pl source code...

/usr/bin/pflogsumm.pl (original)
while(<>) {
        next if(defined($dateStr) && ! /^$dateStr/o);
        s/: \[ID \d+ [^\]]+\] /: /o;        # lose "[ID nnnnnn some.thing]" stuff
        my $logRmdr;
        next unless((($msgMonStr, $msgDay, $msgHr, $msgMin, $msgSec, $logRmdr) =
    

...add the comments and regex as outlined below in bold.

/usr/bin/pflogsumm.pl (modified)
while(<>) {
        next if(defined($dateStr) && ! /^$dateStr/o);
        s/: \[ID \d+ [^\]]+\] /: /o;        # lose "[ID nnnnnn some.thing]" stuff
        #------------------------------------------------------------------------
        # metalog hack by David B. Ferguson <dferguson@linuxnet.ca> 08/19/2008
        # see http://linuxnet.ca/postfix/pflogsumm_metalog.html for latest
        s/\[(postfix|$syslogName)\/(.*)\] /metalog $1\/$2\[54321\]: /;
        #------------------------------------------------------------------------
        my $logRmdr;
        next unless((($msgMonStr, $msgDay, $msgHr, $msgMin, $msgSec, $logRmdr) =
    

Last updated: 01/07/2016

David B. Ferguson <dferguson@linuxnet.ca>