Download CanIt-PRO Administration Guide

126
APPENDIX D. CANIT-PRO LOGGING
Event messages Event log messages provide information about the normal operation of CanIt-PRO
in a format that is both human readable and machine parseable. These are logged at the ’info’
level.
Warning messages Warning messages indicate that an undesirable, but non-fatal, condition has occurred. These are logged at the ’warning’ level.
Error messages Error messages indicate that a failure has occurred within CanIt-PRO and should be
attended to immediately. These are logged at the ’error’ level.
D.2
Event Log Format
Event messages are logged in a format designed to be both human-readable and machine-parseable.
This format consists of comma-separated key=value pairs, where the key consists of entirely lowercase alphabetic characters, and the value consists of arbitrary text appropriate for that key, with problematic characters such as newlines and commas replaced with a % followed by their two-digit hexadecimal value.
With the exception of what, which always appears first, and subject, which will appear last if
present, the key/value pairs cannot be assumed to occupy any specific position in the log line. Depending on where and why the message was logged, different keys will be present.
An example log message is:
Jan 01 13:10:31 oxygen mimedefang.pl[9813]: CanIt: j4CHAVtu009864:
what=accepted, nrcpts=1, relay=192.168.10.8, score=2.5,
[email protected], stream=user1,
subject=Yes%2C this is an example
(We have wrapped the output for readability; in reality, the log message would appear on a single line.)
Here we see the standard date, time, hostname, process name, and process ID from syslog, the name
CanIt:, the sendmail queue ID for the message being processed, and a number of key-value pairs
separated by commas.
The keys that can appear in an “event” log line are:
what This field provides the first indication of what happened to the message. The ’reason’ and
’detail’ fields provide further information
Valid values for ’what’ are:
accepted Message was accepted and relayed through. The ’reason’ field may contain
one of: approved, sender-whitelisted, domain-whitelisted, host-whitelisted, unscannedtoobigskip-spam-scan, opt-out, or no reason at all if none of those cases apply.
rejected Message (or sender, or recipient) was rejected and the sending relay was given a 5xx
failure code. The ’reason’ field may contain one of: auto-reject, auto-reject-no-incident,
blacklisted-recipient, domain-blacklisted, exe, ext, host-blacklisted, invalid-recipient,
mime, mismatch-blacklist, rbl-blacklisted, sender-blacklisted, too-large, or virus.
tagged Message was tagged and relayed through. what=tagged log lines will not contain a
’reason’ field.
CanIt-PRO — Roaring Penguin Software Inc.