awstats parse of postfix mail log drops all records

Question

I'm trying to get awstats to parse the postfix mail log, but it drops allmost all entries with messages like:

Corrupted record (date 20091204042837 lower than 20091211065829-20000): 2009-12-04 04:28:37 root root localhost 127.0.0.1 SMTP - 1 17480

Few more are dropped with an invalid LogFormat:

Corrupted record line 24 (record format does not match LogFormat parameter): 2009-11-16 04: 28:22 root root localhost 127.0.0.1 SMTP - 14755

My conf LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd" I believe matches the log format (and besides is the log format I've seen everywhere for awstats mail parsing). Besides, is the same entry format as all the other entries in the mail log.

Whatever is left is dropped too:

Dropped record (host localhost and 127.0.0.1 not qualified by SkipHosts): 2009-12-07 04:28:36 root root localhost 127.0.0.1 SMTP - 1 17152

I added SkipHosts="" to the .conf file but to no avail.

I feel like awstats really has some personal quarrel with me today.

Answer 1

Several different issues here:

1. awstats requires chronologically sorted input logs. If you have a single log file, sort (man sort(1)) should be enough. If you have multiple log files you can use logresolvemerge.pl

2. the reported line is missing a field:

   • %time2 = 2009-11-16 04: 28:22
   • %email = root
   • %email_r = root
   • %host = localhost
   • %host_r = 127.0.0.1
   • %method = SMTP
   • %url = -
   • %code = 14755
   • %bytesd = [missing]

If the amount is not significant, I would simply delete such lines, maybe they have been corrupted in some way.

Answer 2

try HostAliases="127.0.0.1 ...

in all honesty though it makes me wonder if Postfix set up wrong. gfe/oh