QMAIL2DLF.IN(1)

NAME
qmail2dlf - convert sanitized qmail logs to dlf

SYNOPSIS
qmail2ldf

DESCRIPTION
qmail2dlf reads from stdin, writes dlf to stdout, and, in case of errors, complains on stderr.

TIMESTAMPS
We expect timestamps which look like e.g. `977359048.466280500' in our log: number of seconds since the epoch, in any precision. The log should feature lines which look something like:

 982584201.511524 info msg 6426: bytes 3537 from
   <qmail-return-63074-joostvb=mdcc.cx@list.cr.yp.to> qp 21089 uid 70
splogger, as distributed with qmail, writes `a numerical timestamp', ie something like 972802273.627578, indicating seconds and nanoseconds since the beginning of 1970.

multilog, as distributed with daemontools, http://cr.yp.to/daemontools.html, if invoked with action t, writes a `@' and a tai64n format timestamp. These timestamps look like e.g. 4000000039ef8532346bb35c. Note that 0x400000000000000000000000 is 2^62.

One can get the current time in tai64 format by doing:

 echo 40000000`(echo obase = 16; date +%s) | bc`00000000
(assuming GNU date is installed)

To convert tai64n to numerical timestamps, one can use Russ Allbery's tai64nfraq. It's in the public domain, available from http://www.qmail.org/tai64nfrac.

EXAMPLE
To process a log as produced by splogger:

 $ lr_desyslog qmail < mail.log | qmail2dlf
To process a log as produced by multilog:

 $ tai64nfrac < current | qmail2dlf

BUGS
We don't deal with bounces:

 email qmail none qmail2dlf info skipping line '986244190.800217 bounce msg
  6306 qp 28445': first field should be one of 'new', 'info', 'starting',
  'delivery', 'end' or 'status:', not 'bounce'

VERSION
$Id: qmail2dlf.in,v 1.16 2001/11/10 22:22:48 flacoste Exp $

COPYRIGHT
Copyright (C) 2000-2001 Stichting LogReport Foundation LogReport@LogReport.org

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html or write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.

AUTHOR
Joost van Baal <joostvb@logreport.org>