Xmail Logging - Which Facility?

Hi there,

I'm using XMail on my Debian Server. I'd like to catch XMails log messages with my syslog. Since XMail uses syslog, it has a log facility. But which? XMail does not log under the facility "mail" (which would be a better way, IMO).
So does anybody know under what facility XMail does logging? Three hours of googling and manpaging weren't successfull...

cu, pgs

XMail cannot use syslog. It logs to /var/MailRoot/logs only.

Hmm, but in the XMAil documentation is written:

"[...] Since XMail use syslog to log messages, enable syslogd if it's not running. [...]"

So, if i understood right, XMail uses syslog, and when a process uses syslog, it has to do so under a facility?

cu, pgs

Oops you are right. But browsing its source code shows, that it just uses syslogd to log initial startup errors. All other errs are written to it's own logs. It's facility is 'XMail'. If it starts up well, you will never see anything in the syslogd logs ....

OK, thanks a lot for searching the source. I tried to, but didn't know where and what and how :-(

I think I'm gonna use syslog-ng to extract the relevant data out of the existing logfiles.

EOT, I think.

cu, pgs

A text search for 'syslog' did the trick

One of the things I use syslog for is real time monitoring of hacking attacks. Is there an easy way to feed the data going into the xmail logs into a program in realtime? I've seen a lot of pop3 password brute force attacks lately and I'd like to kill the IP while they are happening. Tail -F won't work because xmail creates a new filename.

what's the preferred way to mod xmail so that new versions are compatible?

The logging can only be modified in its source code which has to be applied again manually with each update.

Thanks Harald. I just looked at the code and it looks like it will be pretty easy to send data to syslog. Most of the needed functions are already there just disabled if not in debug mode.

Actually, not true. Facilities in syslog are predefined. Thanks to Davide for open source, I now have XMail logging to facility "local0". Very minor changes needed to accomplish.

Good job ... feel free to post your changes here if you want to share them.

What format would you want them posted in? My server is FreeBSD so the changes may be slightly unix-specific (though I wouldn't think it matters much.)

Here's the changes as unix "diff" output:

diff SysDep.h SysDep.h.sav
32d31
< #define LOG_LEV_POP3 9

diff POP3Svr.cpp POP3Svr.cpp.sav
361,369d360
< SysLogMessage(LOG_LEV_POP3, "\"%s\""
< "\t\"%s\""
< "\t\"%s\""
< "\t\"%s\""
< "\t\"%s\""
< "\t\"%s\""
< "\n", POP3S.szSvrFQDN, POP3S.szSvrDomain, SysInetNToA(POP3S.PeerInfo, szIP),
< szTime, POP3S.szUser, POP3S.szPassword);
<

diff SysDepUnix.cpp SysDepUnix.cpp.sav
1567c1567
< syslog(LOG_LOCAL0 | LOG_INFO, "%s", szBuffer);
---
> syslog(LOG_DAEMON | LOG_ERR, "%s", szBuffer);
1602d1601
< case LOG_LEV_POP3:

Note that this change only logs POP3 login attempts to syslog. Also, these changes are for xmail 1.24 (still having troubles with 1.25).

John

Thanx!