Tools for Email Tracing

Question

Our mail system consists of 2 frontend postfix mailservers, 2 backend MS Exchange servers, and 2 additional postfix servers hosting pop3 mailboxes and aliases.

Occasionally I am required to trace an email from server to server, to find out what happened to it (ie. where it ended up / why it bouced / why it was quarantined, etc.). MS Exchange provides a nice tool for doing this on the Exchange boxes, but in order to trace it on the linux boxes I have to manually search the mail logs, matching MessageID's from server to server.

Is there a tool that can help automate this task of tracing the life and travels of an email?

Answer 1

You could forward the mail logs via syslog from all those servers to one machine so at least all the logs would be in the same file. Then grep is your friend.

Answer 2

I would say that consolidating those logs via syslog or Splunk is probably your best bet here. *nix systems will use syslog via default, and here is an example of some code that can help you do the same for Exchange.

If you consolidate via syslog, you could write a web interface or command line tool to automate your search.

Answer 3

AWStats provides some useful stats for email, and might provide the functionality you are requesting.

Answer 4

I don't know how you have access to the Linuxbox. But i whould prefer an Logparser Setup that parser the Logs on all Systems with a given parameter. I'm sure you could do a little script with them. As a sample you could setup http access on you linux for internals and get the logfiles FROM http://www.microsoft.adatum.com/MyLogFiles/example.log.

My exchange colleges tracking logfiles as well with Logparser.

http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07