[PLUG] Mail log reporting differences

[Rich Shepard]

On Thu, 3 May 2018, Jim Garrison wrote:

> Maybe they don't look at the same 24-hour period? Do they run at exactly
> 00:00? I believe logwatch looks at the timespan since it last ran and
> pflogsumm (-yesterday) uses 00:00-24:00. Just an educated guess.

Hi Jim,

   I left the timestamp on both results. Here, /etc/cron.daily runs at 03:10
am. The logwatch script is the first to run and pflogsumm is the second to
run. This morning, logwatch ran at 03:10:04 and pflogsumm at 03:10:05 so
they're both looking at /var/log/maillog. The mail logs rotate with all
other log rotations at 04:40 each day.

   So both scripts are looking at the same maillog contents. And, if a
message did arrive in the 1 second between the two scripts running then the
latter would show a larger number of received and rejected messages and not
the fewer that it always does.

Regards,

Rich