Having just spent the morning tracking down how to make qmailanalog work with the qmail files that are generated by multilog, the current qmail logger of choice, and not by splogger, the old logger of choice, when qmailanalog was written, I will now write things down here for my own edification, as well as any others.
This information was compiled via Life with Qmail, the qmail mailing list archives, the poor qmailanalog docs, and some cursing.
1: The logs your're looking for are in /var/log/qmail/send, probably. Strangely enough, this is both email being sent in, and email being sent out. /var/log/qmail/smtpd is not at issue.
2: The logs timestamps are in tai64 format; they need to be in tai64nfrac format. See below for a c program to do this.
3: Therefore, you takes your qmail log, and runs it through tai64nfrac. This converts the timestamps.
4: Then, you runs it through the matchup program that comes with qmailanalog. This converts the log file from mutliple lines per session to one line per session, sendmail style.
5: Then, you runs the output of THAT through the 'zwhatever' programs, such as 'zoverall,' to get the stats you need.
The trick here, obviously, is that the logs aren't in the format that qmailanalog wants, and qmailanalog was never updated to deal with that fact. That, and the tai64nfrac program isn't included with the qmail programs.
Here's that program, gotten from http://www.qmail.org/tai64nfrac and hopefully slashcode won't mangle it into uselessness.
/* $Id$
Convert external TAI64N timestamps to fractional seconds since epoch.
Written by Russ Allbery <rra@stanford.edu>
This work is in the public domain.
Usage:
tai64nfrac < input > output
Expects the input stream to be a sequence of lines beginning with @, a
timestamp in external TAI64N format, and a space. Replaces the @ and the
timestamp with fractional seconds since epoch (1970-01-01 00:00:00 UTC).
The input time format is the format written by tai64n and multilog. The
output time format is expected by qmailanalog. */
#include <stdio.h>
/* Read a TAI64N external format timestamp from stdin and write fractional
seconds since epoch (TAI, not UTC) to stdout. Return the character after
the timestamp. */
int
decode(void)
{
int c;
unsigned long u;
unsigned long seconds = 0;
unsigned long nanoseconds = 0;
while ((c = getchar()) != EOF) {
u = c - '0';
if (u >= 10) {
u = c - 'a';
if (u >= 6) break;
u += 10;
}
seconds <<= 4;
seconds += nanoseconds >> 28;
nanoseconds &= 0xfffffff;
nanoseconds <<= 4;
nanoseconds += u;
}
seconds -= 4611686018427387914ULL;
printf("%lu.%lu ", seconds, nanoseconds);
return c;
}
int
main(void)
{
int c;
unsigned long seconds;
unsigned long nanoseconds;
while ((c = getchar()) != EOF) {
if (c == '@') c = decode();
while (c != EOF) {
putchar(c);
if (c == '\n') break;
c = getchar();
}
}
}
