Unix and Linux network configuration. Multiple network interfaces. Bridged NICs. High-availability network configurations.


Reviews of latest Unix and Linux software. Helpful tips for application support admins. Automating application support.


Disk partitioning, filesystems, directories, and files. Volume management, logical volumes, HA filesystems. Backups and disaster recovery.


Distributed server monitoring. Server performance and capacity planning. Monitoring applications, network status and user activity.

Commands & Shells

Cool Unix shell commands and options. Command-line tools and application. Things every Unix sysadmin needs to know.

Home » Postfix

Install Pflogsumm PostFix Log Summarizer

Submitted by on March 12, 2013 – 9:58 am One Comment

Pflogsumm is yet another log analyzer/summarizer for Postfix. It is written in Perl and has been around for a while. Very simple to install, so I writing this post mostly as a note to myself. I added an example cron job with some “grep” syntax to cut the Pflogsumm report down to size by dropping some things I am usually not interested in.

While Pflogsumm has an option to set the desired level of detail, it doesn’t quite control the output they way I would like. So here it is:

mkdir -p /var/adm/bin
cd /var/adm/bin
gzip -d pflogsumm-1.1.3.tar.gz
tar xvf pflogsumm-1.1.3.tar
cd pflogsumm-1.1.3/
ln -s /var/adm/bin/pflogsumm-1.1.3/ /usr/bin/logsum
/bin/rm -f /var/adm/bin/pflogsumm-1.1.3.tar
logsum -d today /var/log/maillog | more

The report looks something like this:
Postfix log summaries for Mar 12

Grand Totals

  11488   received
   9657   delivered
      0   forwarded
     76   deferred  (784  deferrals)
     44   bounced
  20200   rejected (67%)
      0   reject warnings
      0   held
      0   discarded (0%)

 494699k  bytes received
    519m  bytes delivered
   4857   senders
   2322   sending hosts/domains
   2537   recipients
    807   recipient hosts/domains

Per-Hour Traffic Summary

In the report I want to see sender/recipient stats, but I want to omit domains that sent or received just a few emails. I just want to see the big-hitters and there is no option in Pflogsumm to omit the small guys. And I added some basic “grep” syntax to my cron job that emails a daily report to me.
55 23 * * 1,2,3,4,5 timeout 300 logsum -d today /var/log/maillog | egrep -v "(^[ ]*[ ][0-9][ ]|^[ ]*[ ][0-9][0-9][ ])" | mailx -s "`hostname -s` PostFix Stats `date +'%Y-%m-%d %H:%M'`" 2>&1

The “timeout” command is optional. It will simply kill the pflogsumm script if it is still running after five minutes. This would usually be a sign of a problem and you don’t want the script to consume all of your system’s resources. The “egrep” piece will drop any lines that begin with a one- or two-digit number. This will omit stats for minor senders and recipients  making the report easier to read.

Another option is to run the cron job via SSH from another server. This way you can keep your scripts in one location, which can be useful if you have many mail servers. You would need passwordless SSH configured with passwordless sudo. Write a script to loop through your list of PostFix servers and schedule it to run via cron:

SSH="ssh -qT -o PubkeyAuthentication=yes -o PasswordAuthentication=no -o StrictHostKeyChecking=no"
for host in host1 host2 host3
	/usr/bin/timeout 300 ${SSH} "${host}" "sudo su - root -c "hostname ; /usr/bin/logsum -d today /var/log/maillog | 
	egrep -v \"(^[ ]*[ ][0-9][ ]|^[ ]*[ ][0-9][0-9][ ])\""" | 
	mailx -s "${host} PostFix Stats `date +'%Y-%m-%d %H:%M'`"

Chmod it 755 and schedule the cron job to run it:
50 23 * * 1,2,3,4,5 /home/you/ >/dev/null 2>&1


Print Friendly, PDF & Email

One Comment »

  • Anonymous says:

    What to do when logrotate is set-up to write the mail logs to /var/log/maillog-20160628. I mean dynamic dates in the log filename.
    In your script you have a static /var/log/maillog file.

Leave a Reply

%d bloggers like this: