/usr/share/logsparser/normalizers/postfix.xml is in python-logsparser 0.4-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 | <?xml version="1.0" encoding="UTF-8"?>
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- pylogparser - Logs parsers python library -->
<!-- Copyright (C) 2011 Wallix Inc. -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- This package is free software; you can redistribute -->
<!-- it and/or modify it under the terms of the GNU Lesser -->
<!-- General Public License as published by the Free Software -->
<!-- Foundation; either version 2.1 of the License, or (at -->
<!-- your option) any later version. -->
<!-- -->
<!-- This package is distributed in the hope that it will be -->
<!-- useful, but WITHOUT ANY WARRANTY; without even the implied -->
<!-- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -->
<!-- PURPOSE. See the GNU Lesser General Public License for -->
<!-- more details. -->
<!-- -->
<!-- You should have received a copy of the GNU Lesser General -->
<!-- Public License along with this package; if not, write -->
<!-- to the Free Software Foundation, Inc., 59 Temple Place, -->
<!-- Suite 330, Boston, MA 02111-1307 USA -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!DOCTYPE normalizer SYSTEM "normalizer.dtd">
<normalizer name="postfix"
version="0.99"
unicode="yes"
ignorecase="yes"
matchtype="match"
appliedTo="body"
taxonomy="mail">
<description>
<localized_desc language="en">Postfix log normalization.
Postfix logs consist of a message UID and a list of keys and values.
Normalized keys are "client", "to", "from", "orig_to", "relay", "size", "message-id" and "status".</localized_desc>
<localized_desc language="fr">Ce normaliseur analyse les logs émis par le service Postfix.
Les messages Postfix consistent en un UID de message et une liste variable de clés et de valeurs associées.
Les clés extraites par ce normaliseur sont "client", "to", "from", "orig_to", "relay", "size", "message-id" et "status".</localized_desc>
</description>
<authors>
<author>mhu@wallix.com</author>
</authors>
<tagTypes>
<tagType name="postfixUID" type="basestring">
<description>
<localized_desc language="en">the hexadecimal message UID</localized_desc>
<localized_desc language="fr">l'UID associé au message, exprimé sous forme d'un nombre hexadécimal</localized_desc></description>
<regexp>[0-9A-F]{11}</regexp>
</tagType>
</tagTypes>
<callbacks>
<callback name="decode_postfix_key_value">
# find the component and trim the program
if log.get("program", "").startswith("postfix"):
log["component"] = log['program'][8:]
log["program"] = "postfix"
ACCEPTED = [ "client",
"to",
"from",
"orig_to",
"relay",
"size",
"message-id",
"status" ]
# re to trying to match client and relay address
r=re.compile('(?P<host>[A-Za-z0-9\-\.]+)(?P<ip>\[.*\])?(?P<port>\:\d+)?$')
couples = value.split(', ')
for couple in couples:
tagname, tagvalue = couple.split('=', 1)
if tagname in ACCEPTED:
tagvalue = tagvalue.strip('<>')
log[tagname] = tagvalue
if tagname == 'status':
log[tagname] = log[tagname].split()[0]
TRANSLATE = {"to": "message_recipient",
"from": "message_sender",
"size": "len",
"message-id": "message_id"}
for k,v in TRANSLATE.items():
if k in log.keys():
val = log[k]
del log[k]
log[v] = val
if 'client' in log.keys():
host, ip, port = r.match(log['client']).groups()
if host:
log['source_host'] = host
if ip:
log['source_ip'] = ip.strip("[]")
if port:
log['source_port'] = port.strip(':')
if 'relay' in log.keys():
host, ip, port = r.match(log['relay']).groups()
if host:
log['dest_host'] = host
if ip:
log['dest_ip'] = ip.strip("[]")
if port:
log['dest_port'] = port.strip(':')
</callback>
</callbacks>
<prerequisites>
<prereqTag name="program">postfix.+</prereqTag>
</prerequisites>
<patterns>
<pattern name="postfix-001">
<description>
<localized_desc language="en">Generic postfix message with an UID and many key-values couples.</localized_desc>
<localized_desc language="fr">Message Postfix générique comportant un UID et plusieurs couples clé-valeur.</localized_desc></description>
<text>UID: KEYVALUES</text>
<tags>
<tag name="queue_id" tagType="postfixUID">
<description>
<localized_desc language="en">the Postfix message UID</localized_desc>
<localized_desc language="fr">l'UID du message</localized_desc></description>
<substitute>UID</substitute>
</tag>
<tag name="__keyvalues" tagType="Anything">
<description>
<localized_desc language="en">the Postfix key-value couples</localized_desc>
<localized_desc language="fr">les couples clé-valeur du log</localized_desc></description>
<substitute>KEYVALUES</substitute>
<callbacks>
<callback>decode_postfix_key_value</callback>
</callbacks>
</tag>
</tags>
<examples>
<example>
<text>74275790B06: to=<root@ubuntu>, orig_to=<root>, relay=none, delay=0.91, delays=0.31/0.07/0.53/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=ubuntu type=A: Host not found)</text>
<expectedTags>
<expectedTag name="queue_id">74275790B06</expectedTag>
<expectedTag name="message_recipient">root@ubuntu</expectedTag>
<expectedTag name="orig_to">root</expectedTag>
<expectedTag name="relay">none</expectedTag>
<expectedTag name="status">bounced</expectedTag>
<expectedTag name="taxonomy">mail</expectedTag>
</expectedTags>
</example>
</examples>
</pattern>
</patterns>
</normalizer>
|