Postfix Logwatch garbled output after upgrade etch to lenny

siggma · 07-27-2008, 10:16 AM

I can't seem to find an answer to this so I'll post it here.

I run a home sever and I've been using Logwatch to generate a daily email for my perusal. Recently I managed to upgrade from debian etch to lenny, not really wanting to but needing newer versions of a few things. Since then I get no postfix output in my logwatch report.

Postfix itself runs fine and gives me no error on restart. I've purged and reinstalled logwatch but it's the same output. I installed lenny from CD on different hardware where Logwatch runs fine on the meager postfix log files there, but it's still busted on my production server. I've looked at the logwatch site and all files seem to be in place and working. Installed from debian lenny archive.

Here's what I get as output from Logwatch for postfix

Code:

--------------------- Postfix Begin ------------------------ 

 Unknown option: line_style
 Unknown option: notificationsent
 Unknown option: envelopesenderdomains
 Unknown option: sent
 Unknown option: envelopesenders
 Unknown option: attrerror
 Unknown option: forwarded
 Unknown option: reject_reply_patterns
 Unknown option: warned
 Unknown option: rejectetrn
 Unknown option: sentlmtp
 Unknown option: rejectunverifiedclient
 Unknown option: delivered
 Unknown option: postgrey
 Use postfix --help for options
 
 ---------------------- Postfix End -------------------------

My cron.daily looks like this:

Code:

/usr/sbin/logwatch --format html --mailto root

This looks like something from the postfix logwatch filter but I didn't see any bugs reported for this plus it's OK on my test box.
I'm baffled.
Seeking someone elses' experience

-Tom

Mr. C. · 07-28-2008, 03:02 AM

This is a simple problem of having two conflicting postfix-logwatch releases included in your logwatch distribution.. I think lenny is including the newest release of postfix-logwatch, and are doing so by way of patching. It appears the patch has not removed the older postfix filter.

Find your postfix and postfix.conf logwatch filter and definitions files. I'm not sure where they are in Debian, but the default locations are /usr/share/logwatch/*/services, and /etc/logwatch/*/services.

If you can tell me what you've found, I'd appreciate knowing.

You'll want to remove the oldest version of the postfix filter. It should run standalone so that you can tell the version number. Eg:

perl -T /usr/share/logwatch/scripts/services/postfix --version

Do this with each of the files names postfix you find under a logwatch directory.

siggma · 07-28-2008, 11:41 PM

Quote:

Originally Posted by Mr. C.

This is a simple problem of having two conflicting postfix-logwatch releases included in your logwatch distribution.. I think lenny is including the newest release of postfix-logwatch, and are doing so by way of patching. It appears the patch has not removed the older postfix filter.

perl -T /usr/share/logwatch/scripts/services/postfix --version

Do this with each of the files names postfix you find under a logwatch directory.

First, thanks, I would have thought purging and re installing would have corrected this.

Anyway;

Code:

trbailey:~# perl -T /usr/share/logwatch/scripts/services/postfix  --version
postfix: 1.37.01

And I found these:

Code:

/etc/logwatch/postfix-logwatch
/etc/logwatch/postfix-logwatch.conf

And removed them.

and guess what:

Code:

trbailey:~#perl -T /etc/logwatch/scripts/services/postfix  --version
Unknown option: line_style
Unknown option: envelopesenderdomains
Unknown option: byiprejects
Unknown option: reject_reply_patterns
Unknown option: rejectunverifiedclient
Unknown option: sent
Unknown option: attrerror
Unknown option: envelopesenders
Unknown option: warned
Unknown option: rejectetrn
Unknown option: forwarded
Unknown option: delivered
Unknown option: notificationsent
Unknown option: postgrey
Unknown option: sentlmtp
postfix: 1.36.12

I'll take credit for adding the /etc/logwatch/postfix-logwatch and .conf files. But the other must not have been upgraded correctly.

Now running Logwatch gives me correct, and well formatted Postfix output:

Code:

--------------------- Postfix Begin ------------------------

        1   SASL authentication failed
        6   Miscellaneous warnings

    1.753M  Bytes accepted                         1,838,444
    1.796M  Bytes delivered                        1,883,122
 ========   ================================================

       10   Accepted                                  12.35%
       71   Rejected                                  87.65%
 --------   ------------------------------------------------

I do like the new html format

Thanks again!
-Tom

Mr. C. · 07-29-2008, 12:10 AM

Grab the latest version: 1.37.04
http://www.mikecappella.com/logwatch

There are a few fixes since your .01 version.

Have you tried it standalone? If not, you can test it out:

perl -T /etc/logwatch/scripts/services/postfix --detail 5
perl -T /etc/logwatch/scripts/services/postfix --detail 10

The html formatting is done in logwatch itself

I'll mention the issue to the Debian logwatch maintainer. The patch should remove the old version, or overwrite it with the new.