Sendmail & Mailscanner version 2

[adameros]

Ah ha! I found the problem:

RRDTool Command:

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="smtp5 - E-Mail Statistics" \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="# of Messages" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
CDEF:cdefbc=a,-1,* \
AREA:#FFF200FF:"Messages Recieved" \
GPRINT::LAST:"Current\:%8.0lf" \
GPRINT::AVERAGE:"Average\:%8.0lf" \
GPRINT::MAX:"Maximum\:%8.0lf\n" \
AREA:#FF0000FF:"Viruses" \
GPRINT::LAST:" Current\:%8.0lf" \
GPRINT::AVERAGE:"Average\:%8.0lf" \
GPRINT::MAX:"Maximum\:%8.0lf\n" \
AREA:#FF00FFFF:"SPAM" \
GPRINT::LAST:" Current\:%8.0lf" \
GPRINT::AVERAGE:"Average\:%8.0lf" \
GPRINT::MAX:"Maximum\:%8.0lf\n" \
AREA:cdefbc#4444FFFF:"Messages Sent" \
GPRINT::LAST:" Current\:%8.0lf" \
GPRINT::AVERAGE:"Average\:%8.0lf" \
GPRINT::MAX:"Maximum\:%8.0lf\n" \
AREA:#35962BFF:"Relayed" \
GPRINT::LAST:" Current\:%8.0lf" \
GPRINT::AVERAGE:"Average\:%8.0lf" \
GPRINT::MAX:"Maximum\:%8.0lf\n" \
AREA:#8D00BAFF:"Rejected" \
GPRINT::LAST:" Current\:%8.0lf" \
GPRINT::AVERAGE:"Average\:%8.0lf" \
GPRINT::MAX:"Maximum\:%8.0lf\n"

RRDTool Says:

ERROR: invalid rpn expression in: a,-1,*

No idea what it means, but at least it's a clue...

[jefframsey]

adameros, I got that same error at one point, and this is what I did:

Click on 'Data Sources', and then see if you have a data source for watchmaillog. There should be seven of them. I had to create mine manually. To do that, just click 'Add' in the top right, then select the right host and data template. If they are already there, just proceed to the next paragraph.

After you get the data sources created and have verified that they exist, open up graph management, and select your %host% - email statistics graph. There is a pull down menu for each data source, and the correct data sources will be listed there. Set them all up. Save this, then wait until your poller refreshes, and see if you get it. If you refresh your poller manually, don't forget to change the permissions of the rrd files in the /var/lib/cacti/rrd folder back to 777.

This is how I got it working. I hope it helps.

[adameros]

Awesome! It works now.

[waeltec]

What is is logrotate configuration on debian, i have a problem that after logrotate the graph stop getting some data,

please advise urgently

I had a wierd problem that I never ran into before until now. When the logrotate ran to roll the my log files the watchmaillog script seemed to loose it connection to /var/log/maillog.

Well my problem came back again. Once logrotate ran My graphs went all "flat". So with the script update I've started writing out a /var/run/watchmaillog.pid file that we can use in the logrotate configuration to automatically restart the watchmaillog.sh script.

logrotate Configuration
In order to have logrotate restart the watchmaillog.sh script when it rolls the maillog file we need to modify the logrotate configuration for syslog because this is the one that handles the /var/log/maillog rotating. On my FC5 system I had to modify /etc/logrotate.d/syslog and now mine looks like this,
/etc/logrotate.d/syslog

Code: Select all

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/watchmaillog.pid 2> /dev/null` 2> /dev/null || true
        /opt/watchmaillog/watchmaillog.sh
    endscript
}

Basically I added a similar kill that the syslog gets and then restarted the script. HOPEFULLY this fixes my flat graphs. I've also added this section to the main post.

[waeltec]

Dears,

please advise urgently regarding the below issue

After logrotate my graph seems like the below image (Debian 4)

[warnesj]

What is is logrotate configuration on debian, i have a problem that after logrotate the graph stop getting some data,

please advise urgently

Sorry I don't run Debian in my environment, so you might have to refer to the man pages on whatever logger Debian is using. Unless there are some other Debian experts lurking out there.

Dears,
please advise urgently regarding the below issue

After logrotate my graph seems like the below image (Debian 4)

To me that looks like your counters aren't getting reset properly after they are being read. Go into your /opt/watchmailllog directory (if that's were you put the readcounters.sh script) and see if there are some "watchmaillog_reset_" files in there. If not then ensure that your /opt/watchmaillog directory is writable by the account your SNMP daemon is running under. If you see that the counters are just ramping up like that, then it's most likely that the counter "reset" files aren't being created.

[jefframsey]

Dears,

please advise urgently regarding the below issue

After logrotate my graph seems like the below image (Debian 4)

Debian does not use logrotate to rotate the syslog. It uses the sysklogd daemon to do it. I am still trying to figure out a way to properly kill and restart watchmaillog.sh on a debian machine.

According to http://www.ducea.com/2006/06/06/rotatin ... -1-syslog/, Debian uses /etc/cron.daily/sysklogd to rotate the mail.log file each day. I've added the kill and restart lines to that script to see if that is going to do the trick. I'll report back when I have results.

[jefframsey]

It looks like it is working. It's been close to 24 hours since I set it up.

If you are using a debian-based linux, place the following lines at the end of /etc/cron.daily/sysklogd:

Code: Select all

/bin/kill -HUP `cat /var/run/watchmaillog.pid 2> /dev/null` 2> /dev/null || true
/opt/watchmaillog/watchmaillog.sh

This should kill and restart watchmaillog.sh each time that sysklogd restarts the syslog.

UPDATE: This has been working for about 36 hours straight now.

[cursulak]

Would there be anyone who'd be willing to help me out set this up on my server.

I've gone through it and got it all in place. However my troubles are in the script for Exim. I did the mod suggested but my perl scripts just run away and overtake the system eventually. I wind up going in and killing them all and halting the auto run on the script.

However, I am not a programmer or scripter and don't really know where to start to troubleshoot how to get this running. To be honest, I'm still trying to get cacti to work correctly. I had it running well, then after installing this I have found non of my original charts are working...

So before I screw things up more....

for a small fee (neg) if anyone would like to help. please pm me.

Thanks.

[jefframsey]

I think that the fee is not really necessary, as open source is all about people helping each other. We may just help you learn how to fix it, rather than fix it yourself, but we'll get you there one way or another.

To start with, we'll need to know a few things about your setup:

What distro of linux are you using?
Are you getting any graph data at all now?
Can you take a screen shot if the graphs are showing any data?
Also, if you change the 'debug=0' in watchmaillog.sh to 'debug=1' you will get some debug output that may be of some help.

Having said all of that, I'll be on vacation for the next 7 days, so I cannot promise I'll be available very much for a week or so. I should have WiFi in the hotel at night, so I should be able to check in from time to time.

[warnesj]

Would there be anyone who'd be willing to help me out set this up on my server.

Cursulak PM'd me and I'll see if I can help him. But I'm like jefframsey, no fee is necessary. Help one, help all!

[wwwdrich]

Does anyone else have a problem with spikes in the graphs when the logs rotate? I am assuming it is because watchmaillog is resetting the counter to zero, so Cacti takes it as a counter overflow and puts a really big number in the rrd.

Does anyone have a workaround for this? For that matter, is anyone else seeing the problem?

[wazh]

Hi All,

I read the whole forum trying to understand where I went wrong and I cant figure it out. I am currently running fc10 with Cacti Version 0.8.7b

I am seeing no data in the graph area whatsoever. All I can suspect is that it isnt getting passed to cacti.

I am seeing this in the log

01/12/2009 12:10:03 AM - SYSTEM STATS: Time:1.1227 Method:cmd.php Processes:1 Threads:N/A Hosts:3 HostsPerProcess:3 DataSources:13 RRDsProcessed:11
01/12/2009 12:10:02 AM - CMDPHP: Poller[0] Host[1] DS[17] WARNING: Result from SNMP not valid. Partial Result: No Such Object avail
01/12/2009 12:05:03 AM - SYSTEM STATS: Time:1.1588 Method:cmd.php Processes:1 Threads:N/A Hosts:3 HostsPerProcess:3 DataSources:13 RRDsProcessed:11
01/12/2009 12:05:02 AM - CMDPHP: Poller[0] Host[1] DS[17] WARNING: Result from SNMP not valid. Partial Result: No Such Object avail
01/12/2009 12:00:03 AM - SYSTEM STATS: Time:1.1585 Method:cmd.php Processes:1 Threads:N/A Hosts:3 HostsPerProcess:3 DataSources:13 RRDsProcessed:11
01/12/2009 12:00:02 AM - CMDPHP: Poller[0] Host[1] DS[17] WARNING: Result from SNMP not valid. Partial Result: No Such Object avail

I can also see in the watchmaillog_counters file that it is incrementing.

# cat watchmaillog_counters
mess_recv:3347
mess_rejected:8
mess_relay:164
mess_sent:19
mess_waiting:2
spam:4042
virus:0


Please forgive me as I am really new to all this.

Any help would be appreciated.
Thanks
Warren

[warnesj]

Did you modify your snmpd.conf file on your mail server and add in the lines for passing the values contained in the counter file?

[wazh]

Hi,

Yep sure did - I hope. This is what I added.

# Added for Cacti Mail Script
pass .1.3.6.1.4.100.2 /var/opt/watchmaillog/readcounters.sh spam
pass .1.3.6.1.4.100.4 /var/opt/watchmaillog/readcounters.sh virus
pass .1.3.6.1.4.100.5 /var/opt/watchmaillog/readcounters.sh mess_recv
pass .1.3.6.1.4.100.6 /var/opt/watchmaillog/readcounters.sh mess_sent
pass .1.3.6.1.4.100.7 /var/opt/watchmaillog/readcounters.sh mess_relay
pass .1.3.6.1.4.100.8 /var/opt/watchmaillog/readcounters.sh mess_waiting
pass .1.3.6.1.4.100.9 /var/opt/watchmaillog/readcounters.sh mess_rejected
pass .1.3.6.1.4.100.1 /bin/sh /var/opt/count_mqueue_in.sh