Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Postfix decoder: Making ending doubled dot optional #245

Merged
merged 4 commits into from
Dec 17, 2019
Merged

Postfix decoder: Making ending doubled dot optional #245

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bf16910
Postfix decoder: Making ending doubled dot optional
iasdeoupxe Dec 15, 2018
465c34e
Updated regex to make the ending doubled dot optional while keeping
iasdeoupxe Aug 23, 2019
ac9fbcc
Use an on-line example log entry.
iasdeoupxe Aug 23, 2019
c535dfd
Fix example log syntax.
iasdeoupxe Aug 23, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
18 changes: 9 additions & 9 deletions decoders/0220-postfix_decoders.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,16 +11,16 @@
<!--
- Will extract the srcip
- Examples:
- postfix/smtpd[32297]: NOQUEUE: reject: RCPT from unknown[213.255.237.245]: 554
<ce101@ce.metu.edu.tr>: Relay access denied; from=<kryonomm@yahoo.com>
to=<e10445@jubiipost.dk> proto=SMTP helo=<SM01.net>
- postfix/smtpd[472]: warning: 199.249.24.179.list.dsbl.org: RBL lookup error: Host or domain name not found. Name service error for name=199.249.24.179.list.dsbl.org type=A: Host not found, try again
- postfix/smtpd[5268]: warning: 89.248.162.178: hostname no-reverse-dns-configured.com verification failed: Name or service not known
- postfix/master[1741]: warning: process /usr/libexec/postfix/cleanup pid 27541 exit status 1
- postfix/smtpd[32655]: warning: Illegal address syntax from unknown[157.122.148.252] in MAIL command: <adgjlo@78.41.116.116>
- postfix/smtpd[32655]: too many errors after RCPT from unknown[157.122.148.252]
- May 8 08:26:55 mail postfix/smtpd[32297]: NOQUEUE: reject: RCPT from unknown[213.255.237.245]: 554 <ce101@ce.metu.edu.tr>: Relay access denied; from=<kryonomm@yahoo.com> to=<e10445@jubiipost.dk> proto=SMTP helo=<SM01.net>
- May 8 08:26:55 mail postfix/smtpd[472]: warning: 199.249.24.179.list.dsbl.org: RBL lookup error: Host or domain name not found. Name service error for name=199.249.24.179.list.dsbl.org type=A: Host not found, try again
- May 8 08:26:55 mail postfix/smtpd[5268]: warning: 89.248.162.178: hostname no-reverse-dns-configured.com verification failed: Name or service not known
- May 8 08:26:55 mail postfix/master[1741]: warning: process /usr/libexec/postfix/cleanup pid 27541 exit status 1
- May 8 08:26:55 mail postfix/smtpd[32655]: warning: Illegal address syntax from unknown[157.122.148.252] in MAIL command: <adgjlo@78.41.116.116>
- May 8 08:26:55 mail postfix/smtpd[32655]: too many errors after RCPT from unknown[157.122.148.252]
- May 8 08:26:55 mail postfix/smtpd[27712]: NOQUEUE: reject: MAIL from localhost[127.0.0.1]: 452 Insufficient system storage
- May 8 08:26:55 mail postfix/postscreen[22055]: NOQUEUE: reject: RCPT from [157.122.148.242]:47407: 550 5.7.1 Service unavailable...
- May 8 08:26:55 mail postfix/smtpd[27266]: warning: hostname other.host does not resolve to address 1.2.3.4: no address associated with name
- May 8 08:26:55 mail postfix/smtpd[27266]: warning: hostname other.host does not resolve to address 1.2.3.4
-->

<decoder name="postfix">
Expand All @@ -46,7 +46,7 @@
<use_own_name>true</use_own_name>
<parent>postfix</parent>
<prematch>^warning:</prematch>
<regex>^warning: (\S+):|warning: Illegal address syntax from unknown[(\S+)]|warning: hostname \S+ does not resolve to address (\S+): </regex>
<regex>^warning: (\S+):|warning: Illegal address syntax from unknown[(\S+)]|warning: hostname \S+ does not resolve to address (\S+): |warning: hostname \S+ does not resolve to address (\S+)</regex>
<order>srcip</order>
</decoder>

Expand Down