MAILAUDIT(5)

NAME
mailaudit - description of postoffice session audit records

DESCRIPTION

This file describes the auditing format used by the postoffice mail server. Mail audit records are written to the syslog with facility LOG_MAIL and priority LOG_DEBUG. An audit record is a colon-separated line prefixed with the word AUDIT, and it contains the fields

TIME
    The time, in seconds, since the session began,

IP  the IP address of the client,

COMMAND
    the (4 character) SMTP command the client sent (or CONN, which is when the session connects),

CODE
    the SMTP response code postoffice sent in reply to this command (if the code is 499 or 599 it means that the auditing module was not passed the entire response code, just the first digit.), and finally,

INFO
    additional information about the command. Usually this is just the command + arguments passed in to the SMTP server, but for the CONN command it will be the reason why the connection was denied, and for the QUIT command it will say whether the session timed out or the client closed the connection without first issuing a QUIT command.

The audit format does not include the process-id of the SMTP session or the time the record was generated; this is pure laziness because it assumes that any auditing programs can retrieve this data from the syslog.

AUTHOR
David Parsons

SEE ALSO
postoffice(8);

DARPA Internet Request For Comments