Looking for a log analysis program

[FH-9]

We are potentially having a problem w/ emails being delayed (for example I
received one yesterday evening that was sent 2 days earlier).  A quick look at
the headers makes it look like it was the remote system that held on to it for
about 30 hours, however I want to check our logs to make sure there were no
problems on our side as well.  As I'm sure you all know digging through the
logs (especially over multiple days/log files) is not fun.  What I'm hoping
someone can recommend is a program/script that might be able to help w/ this.
I did find the "Logfile analysis" section on http://www.postfix.org/addon.html
but most of those look to be either old or are not quite what I think I'm
looking for (aka they only give general statistics based on the log files but
don't really help w/ debugging).  At quick glance the two that looked the most
hopeful were multitail and AWStats.  Does anyone have any experience w/ using
either of these tools in my situation?  Does anyone have any other
recommendations for other tools they have found useful for this sort of
debugging?  I was hoping there was something w/ a ethereal/wireshark "like"
interface/functionality out there (in particular the search/filtering and the
"conversation" streaming/tracking).  Does something like that exist for log
files?

Thanks

[Simon Waters]

On Friday 06 November 2009 15:42:40 FH wrote:
>
> Does something like that exist for log files?

I use pflogsumm but it's value is more in aggregate data and pulling out
relevant error messages over the log period, than tracking individual
messages.

Where a message is delayed, and headers show it was on the remote server
during that period, then there is nothing on your server to say which
attempts from the remote server would have tried to deliver that message. So
unless you are lucky enough that there was one and only 1 such message
between saids server/sender/recipient, in which case you can just grep for
the servers name in the log file anyway. Otherwise I grep for the server name
and make sure greylisting did what I thought, and ask the remote mail admin.

Similarly in such situations it may be a layer below SMTP that is to blame -
such as routing - when aggregated stats may be the only useful clue anyway.
Since Postfix can't log what never happened to it.