Splunk for Postfix
Overview
- Splunk for Postfix includes dashboards with charts of Message Size, Messages by Status, Real-Time Message Count, Messages by Host, Top Clients, Top Relays, Top Senders, Top Recipients, Max Connection Count, Max Connection Rate, Max Cache Size, Max Simultaneous Connections, Address Lookups, and Domain Lookups
- Summary-index-populating searches are scheduled hourly to efficiently report on large volumes of data
- Quickly and easily view top delivery reasons, errors by host, and common error codes
- Form Searches including Splunk Transactions by Queue ID
- Over 20 field extractions, compliant with the Common Information Model
- All dashboards use the JSChart module to render graphics. JSChart uses JavaScript to build the graphics for a chart. This provides charting support on platforms such as iOS mobile devices that cannot display Flash-based graphics. The JSChart module also provides better printing quality.
- Any feedback, including requests for enhancement are most welcome. Email: luke@verypowerful.info
Screenshots
Setup Splunk for Postfix
Splunk for Postfix should work with the following sourcetypes:
Note: ensure that your relevant sourcetype (eg. syslog) is searchable in an index that can be searched by default when no index is specified.
Add an Index to Splunk (REQUIRED):
- Create an index called summary_postfix then restart Splunk
- Note: all of the dashboards use searches based on index = summary_postfix (which is populated hourly by summary index searches)
Note: wait ~2 hours for the scheduled searches to start populating the summary_postfix index, and then view the included dashboards :)
Backfill the summary_postfix index (Optional)
Splunk includes the fill_summary_index.py script to backfill gaps in summary index collection by running the saved searches that populate the relevant summary index as they would have been executed at their regularly scheduled times for a given time range. In other words, even though your new summary_postfix index only started collecting data for the last hour, if necessary you can use fill_summary_index.py to fill the summary index with data from the past month.
Reference:
Disclaimer
- This app has been created for the specifics of our Postfix environment (Postfix version 2.7.x) and it may or may not suit your specific purposes.
Copyright (c) 2014 Luke Harris. All Rights Reserved.
License
- GNU GENERAL PUBLIC LICENSE Version 3
Versions
v1.1.1
v1.1
- updated field extractions
- added Errors dashboard
v1.0
- initial release (private beta)
