Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Problem: the sendmail default logging configuration does not log per message auth info which I neeed (i.e. I want to know which user/authmethod was used for a certain message id). Following a tip from this entry, I ended up with the following cf lines:

Klog syslog
 # This works
HSubject: $>+LogSubject
 # this does not
HX-Authost: ${mail_host}
HX-Authost: $>+LogAuthAuthor


R$* $: $(log Subject: $1 authenticated-by: $&{auth_type}, $&{auth_authen}, $&{auth_ssf}, $&{auth_author}, $&{mail_mailer}, $&{mail_host}, $&{mail_addr} $) $1

R$* $: $(log Authenticated-by: $1 $&{auth_type}, $&{auth_authen}, $&{auth_ssf}, $&{auth_author}, $&{mail_mailer}, $&{mail_host}, $&{mail_addr} $) $1

The first one yields (in maillog):

sendmail[10814]: r2DEJl9P010814: Subject:the Subject.authenticated by:PLAIN,auser,0,,esmtp,,

The second:

sendmail[10814]: r2DEJl9P010814:,,,,esmtp,,

It does therefore appear that the {auth_xxxx} macro are empty when the second rule fires... but they are not. In fact I can log them if I put them on the H line instead:

HX-Authost: ${mail_host} ${auth_type} ${auth_authen} ${auth_ssf} ${auth_author}
HX-Authost: $>+LogAuthAuthor1

Except I do not want to do this because I would be sending out auth information where I only want to log it. In fact the entire solution is coyote ugly, not to mention horribly kludgey, and I would welcome a better one (one that does not begins with "change MTA"-I am perfectly happy with sendmail)

Please note that raising LogLevel to 10 and above (as has been suggested) appears not to cut it because the auth information is logged once per session (i.e. at login), while what I want is having it in message context.

Cheers, alf

share|improve this question
Do not use the same header name more than once. Try HX-Authost1 and HX-Authost2 – Andrzej A. Filip Mar 14 '13 at 13:30
up vote 2 down vote accepted

You may create log entries you want in check_eoh (end of headers) or check_data rulesets (after smtp data command).

R$*    $: $(log Authenticated-by: $&{auth_type}, $&{auth_authen}, $&{auth_ssf}, $&{auth_author}, $&{mail_mailer}, $&{mail_host}, $&{mail_addr} $) $1

[There should be a TAB before $:]
check_data gets as input number_of_recipients, check_eoh gets as input number_of_headers $| total_headers_bytes

check_mail would be a better place but FEATURE(delay_checks) makes it more tricky.

share|improve this answer
Works as intended (& needed)! THX – Alien Life Form Mar 14 '13 at 16:30

Change LogLevel to fit your needs e.g.

define(`confLOG_LEVEL', `14')dnl Q: Logging of sendmail authenticated user.

In short: Increase LogLevel to 14

RELEASE_NOTES file in sendmail distribution states:

8.10.0/8.10.0   2000/03/01
  Log basic information about authenticated connections at LogLevel 10 or higher.
share|improve this answer
Yes, I tried that - but it is not what I am after. What LogLevel (at 10 or greater) does is giving info about authentication at the session level. What I want (why I want it is another story) is a log line that ties the message ID to the authenticated user. – Alien Life Form Mar 14 '13 at 8:20
OK - I will post another reply better fit to what YOU need. – Andrzej A. Filip Mar 14 '13 at 13:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.