[Mimedefang] GraphDefang ideas

[John Rowan Littell]

-----BEGIN PGP SIGNED MESSAGE-----

Lo, Brent J. Nordquist and the coffee pot sang in unison:

> We have two (MX 10) machines handling the incoming mail load.
> GraphDefang (with its max-time) seems designed to handle only one log file
> (at least, when I ran the second file in, the lines were all discarded,
> presumably because the first file set the max-time).  The only way I could
> do it was cat them together and sort, which will work for the time being.

I might suggest a central syslog server that both the mail exchangers
log to.  At the log server, you could then combine the logs as they
come in, and then run graphdefang on the combined logs.  If you don't
have a third box to use for this, you could probably designate one of
the MXs as the log server (unless you've got a network architecture
that makes this troublesome).

Caveat, though: I've not tried this myself, and I don't know a whole
lot about the innards of graphdefang (I wrote my own log parsing
script before we had either md_log() or graphdefang), so I don't know
if combining logs on a log server would have any hidden gotchas.

  --rowan

- -- 
John "Rowan" Littell
Systems Administrator
Earlham College Computing Services
http://www.earlham.edu/~littejo/
2003-01-30 10:28
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: Made with pgp4pine 1.76

iQCVAwUBPjlF4JdUNSJ2nf/5AQE28gP9GBXD7rmOUez8/xxBcsHWpqvYS7erWM7W
cMBqqlXM4CMZJ8MuBH8EeFAS6CUfH2tmAyHKx5QF8mtnkcHygiJsu5JhGHwbj+Yz
Qh073RAVMIPgxx4P9AFG8r93CT/EFCpeGYLfwzNo+tyXSWqMaWalky5J1Tzaadq4
0uacdBx/i3E=
=4vSQ
-----END PGP SIGNATURE-----