Tips N Tricks

Postfix: Log E-mails’ Subject

In Linux, you can view the statistics of incoming and outgoing E-mails by peeking into a log file called maillog (typically found in /var/log directory). Maillog provides the general information about the mails, for example, the sender and recipient(s), status – sent, rejected, bounced etc. I typically use maillog to check the destiny of mails. At times, it becomes difficult to spot a particular mail due to the sheer volume of mails being logged – especially on a production mail server.

For example: what if we need to check whether a particular mail sent by Person A has been delivered to Person B. Note that Person A might be sending lots of mails to Person B but we need to spot that one particular mail – say the one, which was sent by Person A but did not reach Person B. The only identifier, to identify a particular mail, in the maillog is the cryptic message ID. A better and more readable identifier would be the subject of an E-mail.Unfortunately, the subject of the mails is not logged, by default, in the maillog. But we can configure a mail server like Postfix to log the subject line.

Postfix is a popular E-mail server a.k.a. MTA (Mail Transfer Agent) in the Linux world. With Postfix, it is easy to dump the subject line of every E-mail (incoming and outgoing) in the maillog. Assuming that you have a setup, configured and running Postfix, following is how to achieve it. Note that the path of the configuration files mentioned below are typical to RedHat, CentOS and Fedora Linux.

• Open the file called main.cf, found in /etc/postfix, in a text editor
• Find and uncomment (by removing the preceding #) the line which says:header_checks = regexp:/etc/postfix/header_checks
  
• Save the file
• Next, open the file named header_checks, found in the directory /etc/postfix, in a text editor
• Append the following line to the file:/^Subject:/ WARN
• Save the file and activate the Postfix’s configuration changes by issuing ’service postfix reload’

That’s it. Now in the maillog,  you will see the subject line of every incoming and outgoing mail. It will show  as follows:

Jun 29 06:16:28 mailer postfix/cleanup[473]: 1A96CD40CA: warning: header Subject: It Works! from mailsrv.foo.com[10.1.1.50]; from=<personA@foo.com> to=<personB@foo1.com> …

Note that the Subject (“It Works!” in this case) is logged in the maillog to identify the E-mail quite easily.

© 2009 Shekhar Govindarajan’s Blog.