sendmail administration

Log entry format

Each line in the system log consists of a timestamp, the name of the machine that generated it (for logging from several machines over the local area network), the word "sendmail:", and a message.

The two most common lines are logged when a message is processed. The first logs the receipt of a message; there will be exactly one of these per message. Some fields may be omitted if they do not contain interesting information. Fields are:

from: The envelope sender address.
size: The size of the message in bytes.
class: The class (numeric precedence) of the message.
pri: The initial message priority (used for queue sorting).
nrcpts: The number of envelope recipients for this message (after aliasing and forwarding).
msgid: The message id of the message (from the header).
proto: The protocol used to receive this message (such as ESMTP or UUCP)
relay: The machine from which it was received.

There is also one line logged per delivery attempt (so there can be several per message if delivery is deferred or there are multiple recipients). Fields are:

to: A comma-separated list of the recipients to this mailer.
ctladdr: The ``controlling user'', that is, the name of the user whose credentials we use for delivery.
delay: The total delay between the time this message was received and the time it was delivered.
xdelay: The amount of time needed in this delivery attempt (normally indicative of the speed of the connection).
mailer: The name of the mailer used to deliver to this recipient.
relay: The name of the host that actually accepted (or rejected) this recipient.
stat: The delivery status.

Not all fields are present in all messages; for example, the relay is not listed for local deliveries.