NAME

       qmail2dlf - convert sanitized qmail-send logs to dlf

SYNOPSIS

       qmail2ldf

DESCRIPTION

       qmail2dlf reads qmail-send logs from stdin, writes dlf to stdout, and, in case of errors, complains on
       stderr.

TIMESTAMPS

       We expect timestamps which look like e.g. `977359048.466280500' in our log: number of seconds since the
       epoch, in any precision.  The log should feature lines which look something like:

        982584201.511524 info msg 6426: bytes 3537 from
          <qmail-return-63074-joostvb=mdcc.cx@list.cr.yp.to> qp 21089 uid 70

       splogger, as distributed with qmail, writes `a numerical timestamp', ie something like 972802273.627578,
       indicating seconds and nanoseconds since the beginning of 1970.

       multilog, as distributed with daemontools, http://cr.yp.to/daemontools.html, if invoked with action t,
       writes a `@' and a tai64n format timestamp. These timestamps look like e.g.  4000000039ef8532346bb35c.
       Note that 0x400000000000000000000000 is 2^62.

       One can get the current time in tai64 format by doing:

        echo 40000000`(echo obase = 16; date +%s) | bc`00000000

       (assuming GNU date is installed)

       To convert tai64n to numerical timestamps, one can use Russ Allbery's tai64nfraq. It's in the public
       domain, available from http://www.qmail.org/tai64nfrac.

EXAMPLE

       To process a log as produced by splogger:

        $ lr_desyslog qmail < mail.log | qmail2dlf

       To process a log as produced by multilog:

        $ tai64nfrac < current | qmail2dlf

       qmail2dlf(1) will be rarely used on its own, but is more likely called by lr_log2report:

        $ tai64nfrac < /service/qmail-send/log/main/current | \
            lr_log2report qmail

BUGS

       We don't deal with bounces:

        email qmail none qmail2dlf info skipping line '986244190.800217 bounce msg
         6306 qp 28445': first field should be one of 'new', 'info', 'starting',
         'delivery', 'end' or 'status:', not 'bounce'

       qmail2dlf doesn't use any information from the qmail-smtpd(1) logs.  (These look like

        2002-06-16 09:34:57.798038500 tcpserver: pid 19385 from 100.61.24.7
        2002-06-16 09:34:58.114198500 tcpserver: ok 19385 foo.example.com:100.163.25.11:25 logreport.iae.nl:212.61.24.7:postfix:1189

       .)

VERSION

       $Id: qmail2dlf.in,v 1.24 2006/07/23 13:16:34 vanbaal Exp $

COPYRIGHT

       Copyright (C) 2000, 2001 Stichting LogReport Foundation LogReport@LogReport.org

       This program is free software; you can redistribute it and/or modify it under the terms of the GNU
       General Public License as published by the Free Software Foundation; either version 2 of the License, or
       (at your option) any later version.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even
       the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
       License for more details.

       You should have received a copy of the GNU General Public License along with this program (see COPYING);
       if not, check with http://www.gnu.org/copyleft/gpl.html.

AUTHOR

       Joost van Baal <joostvb@logreport.org>