How to use services and look at logs

Hi,

I decided to write this part of the guide because there are some certain things you should know in the event something happens or if things go really awry.

The first and most important thing to know is how to start, restart or stop a service. Your next question is How do I know what services I have? Well, thats the easy question. Run the following:


# svstat /service/* /service/*/log

The output below is what I get. There is basically a service for everything qmail related (pop, smtp and send), spamassassin, clamav, maillog and freshclam and also a log for each one of them.

/service/clamav: up (pid 2229) 38597 seconds
/service/freshclam: up (pid 2219) 38597 seconds
/service/maildrop-logger: up (pid 2223) 38597 seconds
/service/qmail-pop3d: up (pid 2217) 38597 seconds
/service/qmail-send: up (pid 2224) 38597 seconds
/service/qmail-smtpd: up (pid 2228) 38597 seconds
/service/spamd: up (pid 2221) 38597 seconds
/service/clamav/log: up (pid 2227) 38597 seconds
/service/freshclam/log: up (pid 2220) 38597 seconds
/service/maildrop-logger/log: up (pid 2226) 38597 seconds
/service/qmail-pop3d/log: up (pid 2218) 38597 seconds
/service/qmail-send/log: up (pid 2225) 38597 seconds
/service/qmail-smtpd/log: up (pid 2230) 38597 seconds
/service/spamd/log: up (pid 2222) 38597 seconds

So if any of these services have a 0 or a 1 in them on your server, you would need to check the log. If the log file has a 0 or 1 in it, usually that might mean that the run file isin't chmodded 755 or there is something else wrong. If you can't figure out what it is, Try clicking support in the menu for help.

Restarting, stopping or starting services isin't too hard to do. Look at the following examples:

To restart a service:


# svc -t /service/spamd

To stop a service:
i


# svc -d /service/spamd

To start a service:


# svc -u /service/spamd

I used spamd in the above examples but you can use any service.

So, The next thing to do is how to look at logs. Qmail logs have their own directory and everything else resides within the /service/*/log/main folder. For instance, if you wanted to know where the maildrop logs are, they are in /service/maildrop-logger/log/main under the file current. So if you change to that folder and start to tail the log using:

# tail -f current

You will see the line starting with @400000... This is part of qmails timestamp. You have to use a program like tai64nlocal to view it correctly. Now try it with

# cat current | tai64nlocal

That looks much better!

An easier way to do this is to use aliases in your .tcshrc. I am using tcsh and most people use bash so if you're using bash, this may vary just slightly. What you will want to do is edit your shell's startup file. For users using tcsh, it's usually either ~/.tcshrc or ~/.cshrc. For bash users its usually~/.bashrc. So here is a partial list of my aliases:

alias sendfilter        "tai64nlocal < /var/log/qmail/qmail-send/current"
alias smtpfilter        "tai64nlocal < /var/log/qmail//qmail-smtpd/current"
alias popfilter         "tai64nlocal < /var/log/qmail/qmail-pop3d/current"
alias sslfilter         "tai64nlocal < /service/smtpssl/log/main/current"
alias dropfilter        "tai64nlocal < /service/maildrop-logger/log/main/current"
alias tailsend        "tail -f /var/log/qmail/qmail-send/current | tai64nlocal"
alias tailsmtp        "tail -f /var/log/qmail/qmail-smtpd/current | tai64nlocal"
alias tailpop         "tail -f /var/log/qmail/qmail-pop3d/current  | tai64nlocal"

For bash users, you'll have to add an = inbeween the spacing like so:

alias tailssl="tail -f /service/smtpssl/log/main/current  | tai64nlocal"

So the first 5 aliases will show you the entire log file. So if you type smtpfilter at the prompt, It will give the the output of the /var/log/qmai/qmail-smtpd/current file with the timestamps since the last log rotation. You can grep with this as well so if you want to see all results with just domain.xxx in it, you would do smtpfilter | grep domain.xxx and thats all it would show. This would prove the same with each filter

The next 4 just follow the log.  So if you type tailpop, It will follow the pop3d logs until you stop it.