topic Re: Postfix Queue ID in Splunk Search

Postfix Queue ID

thartmann — Sat, 20 Feb 2010 01:09:34 GMT

I've been able to extract Postfix Queue ID's out of sourcetype="postfix_syslog" however often logs have multiple Queue ID's, and I'd like to extract the ID's, and use them to build transaction across postfix log events, events where postfix hands the logs off to another process, such as amavis and when one MTA hands the message to another server in the farm, allowing me to build the complete transaction of a mail message from acceptance at the border, filtering and final delivery! Has anyone been able to write an extraction the takes events with two Queue ID's and correctly maps the "Secondary" to the "Primary" in a related event?

Thanks

Re: Postfix Queue ID

Mick — Sat, 20 Feb 2010 01:44:38 GMT

So what's the question, how to extract mulitple Q ID's? How to build a transaction?

Re: Postfix Queue ID

jrodman — Sat, 20 Feb 2010 06:03:20 GMT

I think you're looking for the transaction feature: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Abouttransactions

Transactions combine together multiple events with some automatically created fields like how long the transaction took.

They can be defined ad-hoc as part of a search: http://www.splunk.com/base/Documentation/4.0.9/SearchReference/Transaction or the

Or they can be stored/persisted in configuration: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Definetransactions

Re: Postfix Queue ID

Justin_Grant — Tue, 23 Feb 2010 03:28:07 GMT

Can you add a sample line(s) from the log you're trying to use? I think you're asking about how to create a transaction when there are multiple QID values in the same log line, but seeing examples of the specific events you're trying to handle will be helpful to clarify.

Re: Postfix Queue ID

marcoscala — Mon, 28 Sep 2020 11:33:21 GMT

Jrodmap,
The problem is not so easy and doc doesn't help. I've been doing the same here with a prospect customer. Transaction can't fully help becuse the several events to correlate never have ALL the same fields needed to "transaction" command. The transaction flows from one log to the other, and the startling identifying field (queue_id) then must be linked to the "from" field and a "message_id" in the amavis logs.

So, how is it possible to link events correlated from a chain of different fields?

Regards,
marco