I am running Postfix on a linux box with a couple hundred local users with mailboxes.

Is there a way to monitor all incoming connections (SMTP) to the Postfix service? I.e. a live stream of "IP Address x.x.x.x just connected to the Postfix server" and "IP Address y.y.y.y just disconnected" ?

I want to monitor all incoming connections so I can look for trends of the same IP address attempting to send multiple spam to my users or possibly trying to relay (it's not an open relay btw!).

Just dumping all connections and disconnections, with IP address listed, to a text file or syslog would be perfect. Or possibly there is another, better way?


  • I don't understand the down-votes... What's wrong with this question? Sep 21, 2017 at 3:30

4 Answers 4


postfix logs each connection as it comes in, and the log lines look like

Jul  8 16:25:15 swiss postfix/smtpd[11127]: connect from some.host.or.other []

so you can tail -F your logfile (on my system it's /var/log/mail.log), use grep to filter the lines you want, and watch the live traffic.

  • Any way to tell when these connections are disconnected? Jul 8, 2014 at 15:35
  • 2
    The same way. They appear right in the same log! Jul 8, 2014 at 16:02

The above poster is close.

tail allows you to see the last 10 lines in a file. The -f switch allows you to see new lines as they are appended to the maillog file.

cd /var/log

tail -f maillog

Ctrl+c to escape.

Seeing this is already written to a file called /var/log/maillog, not sure why you would want to create another file unless you are looking to extract specific information.

If you want to just read the maillog, use your favorite editor or do this:

less maillog

hitting the Enter (return) key will move the file down a single line at a time or you can hit the Page Down key for a full screen move.

HHitting the q key will escape you out.

  • Bare in mind that tail -f <anyfile> will not follow a logfile which is replaced, i.e. by logrotate. The GNU tail has the tail -F option which will follow the filename, even if it is replaced.
    – sastorsl
    Nov 15, 2020 at 10:32

I found the following helpful:

tail -f maillog | grep connect

But you could grep for disconnect or a specific IP if you wanted?

  • 1
    This only shows new connections as they happen. Not a list of all current active connections. Something like the 'top' command would be best, with a realtime display of all connections and their IP addresses. Sep 20, 2017 at 12:08

This will give you a count of all the IPs in your mail.log file so you can identify nuisance IPs.

grep connect /var/log/mail.log |grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | sort | uniq -c | sort

Use ipset to create blacklists and add them in your ip tables

Create blacklists:

ipset create <nameof blacklist> hash:ip (or net) -hashsize 4096

ipset add <nameof blacklist> <IP or network/nn>

Match blacklists and drop:

iptables -I INPUT -m set --match-set <nameof blacklist> src -j DROP
iptables -I FORWARD -m set --match-set <nameof blacklist> src -j DROP

You could probably script and automate this.

Not the answer you're looking for? Browse other questions tagged or ask your own question.