qmail2dlf1

Usage

Overview

qmail2dlf reads qmail-send logs from stdin, writes dlf to stdout, and, in case of errors, complains on stderr.

Timestamps

We expect timestamps which look like e.g. `977359048.466280500' in our log: number of seconds since the epoch, in any precision. The log should feature lines which look something like:

 982584201.511524 info msg 6426: bytes 3537 from 
   <[email protected]> qp 21089 uid 70

splogger, as distributed with qmail, writes `a numerical timestamp', ie something like 972802273.627578, indicating seconds and nanoseconds since the beginning of 1970.

multilog, as distributed with daemontools, http://cr.yp.to/daemontools.html, if invoked with action t, writes a `@' and a tai64n format timestamp. These timestamps look like e.g. 4000000039ef8532346bb35c. Note that 0x400000000000000000000000 is 2^62.

One can get the current time in tai64 format by doing:

 echo 40000000`(echo obase = 16; date +%s) | bc`00000000

(assuming GNU date is installed)

To convert tai64n to numerical timestamps, one can use Russ Allbery's tai64nfraq. It's in the public domain, available from http://www.qmail.org/tai64nfrac.

Examples

To process a log as produced by splogger:

 $ lr_desyslog qmail < mail.log | qmail2dlf

To process a log as produced by multilog:

 $ tai64nfrac < current | qmail2dlf

qmail2dlf(1) will be rarely used on its own, but is more likely called by lr_log2report:

 $ tai64nfrac < /service/qmail-send/log/main/current | \
     lr_log2report qmail

Version

$Id: qmail2dlf.in,v 1.24 2006/07/23 13:16:34 vanbaal Exp $