sendmail subject logging

thope · 08-06-2010, 12:11 PM

I am looking for the syntax for a sendmail ruleset to log the message subject to the syslog service. I have found a few posts on the web, but none seem to work. The basic appear to be - add the following to the sendmail.mc file then compile the sendmail.cf file using M4. The syntax suggested follows (I believe the rewrite rule is incorrect)(I and using <T> to indicate tabs):

LOCAL_CONFIC
Klog syslog
HSubject:<T>$>Check_Subject

LOCAL_RULESETS
SCheck_Subject
R$*<T>$:<T>$(log Subject=$1<T>$)<T>$1

sendmail.cf compiles and when used as the config file for sendmail - everything appears to work, but no subject is logged.

any suggestions would be greatly appreciated.
Thanks to all.

bathory · 08-06-2010, 04:12 PM

Hi,

Take a look at the 2nd post here

BTW, the only <Tab> you need is in the ruleset, after the R$*. Check sendmail.cf if it is preserved.

Code:

LOCAL_CONFIG
Klog syslog
HSubject: $>+CheckSubject

LOCAL_RULESETS
SCheckSubject
R$*<Tab>$: $(log Subject: $1 $) $1

Regards

thope · 08-06-2010, 06:08 PM

Thanks bathory

The post you referenced was one of the spots I found and tried. Must either be a typo or some other config issue. I am using slackerware 13 running sendmail version 8.14.3. I have retyped the lines into my .mc file (made a copy of the sendmail-slackware.mc file under /usr/share/sendmail/cf/cf called sendmail-slackware-subject-logging.mc. I then run the M4 compiler using the command line:
m4 sendmail-slackware-subject-logging.mc >sendmail-slackware-sunject-logging.cf
After compiling with no warnings or errors, copy the .cf file to /etc/mail/ (original was renamed to preserve it)
I then cd to /etc/mail and copy the sendmail-slackware-subject-logging.cf to sendmail.cf then restart sendmail.
when I send a test message, the message gets delivered - but no subject is logged to /var/log/maillog

Am I doing something in the wrong order?
could I have missed some prerequisite set related to syslog levels?

Thanks for the quick response,
Terry

bathory · 08-07-2010, 03:48 AM

Hi,

I'm also using Slackware (it's 13.1 and sendmail version is 8.14.4, but I guess it doesn't matter). I've tested both variations in that post and they both work.
Just note that you have to add the code at the end of the .mc file (I'm using sendmail-slackware-tls-sasl.mc where there is already a LOCAL_CONFIG for ssl), after the MAILER definitions.

Regards

thope · 08-09-2010, 02:55 PM

I am attaching the .mc file in case anyone can see an error.

Does anyuone have a breakdown of the rewrite rule and how it is parsed?

bathory · 08-09-2010, 03:58 PM

FYI, your .mc works also here.

Quote:

Does anyuone have a breakdown of the rewrite rule and how it is parsed?

I guess you mean where it's written in sendmail.cf. If that's the case, then using your .mc, I have in the resulting sendmail.cf:
starting from line 171:

Code:

Klog syslog
HSubject: $>+CheckSubject


# Configuration version number
DZ8.14.4

and from line 1706

Code:

SCheckSubject
R$*     $: $(log Subject: $1 $) $1
#^L
######################################################################
######################################################################
#####
#####                   MAIL FILTER DEFINITIONS
#####
######################################################################
######################################################################

thope · 08-09-2010, 04:14 PM

Thanks bathory

When asking about the breakdown of the rewrite rule - I should have been more clear. I was hoping for explanations of both the RHS and LHS of the rewrite rule.

I took a stab at moving the line with the HSubject:... down below the LOCAL_RULESETS line and now it logs the subject in the /var/log/maillog file as expected.

Thanks for all the assistance. Hope I wasn't too big a pain in the @$$!

Terry

bathory · 08-09-2010, 04:27 PM

No worries.
Glad to see you've made it

Cheers