MTA Message Logging Application.

Question

Hi,
Apologies if this isn't the ideal place to post this question but I was
advised by Novell Support to begin in the Development section and there
doesn't appear to be a good match with any of the forums. If you know of
a more appropriate forum, please advise.
I've been asked to develop an application that can run through GroupWise
6.04 MTA message logging files and collect basic statistics on message
flow e.g. the total number of messages transferred, their direction and
destination domain etc.
Can anyone tell me how to interpret these log files? I imagine that any
response would entail more than a simple email so hopefully somebody
somewhere knows of a document that explains the log file format, key words
etc. and can point me in the right direction.
Thanks in advance,
Andy

Answer 1

Hi David,
Perfect. This is just what I was looking for.
Many thanks to you and Duane for all the help.
Andy
David Mair wrote:
> Andy,
> I received a message from Duane on the GroupWise team yesterday evening.
> There's a TID that documents the GroupWise log format. You can find it here:
>
http://support.novell.com/techcenter...alogId=2320817
> I hope this helps. Good luck with the project.
> David Mair wrote:
> > Andy Cooper wrote:
> >
> >>Hi David,
> >>
> >>The date (month and day, but no year!) can be determined from the file
> >>name (mmddMSG.nnn).
> >
> >
> > stat the file, the year should be in the timestamp.
> >
> >
> >>Many thanks in advance for your help on this. I'll keep my fingers
> >>crossed that someone somewhere has the documentation to hand.
> >
> >
> > I sent a message to one of the GroupWise guys. Post again if I haven't
> > responded within a day or two. Mike hasn't opened my message yet but he
> > may be on vacation.
> >
> >
> >>David Mair wrote:
> >>
> >>
> >>
> >>>Andy Cooper wrote:
> >>>
> >>>
> >>>>Hi David,
> >>>>
> >>>>Thanks for the response.
> >>>>
> >>>>The log files are in plain text. My problem is in interpreting the
> >>>>contents. A random sample is:
> >>>>
> >>>>17:00:39 ARR
> >>>>
> >>
>
>>MSG,LEVAVASS,43298C91.758:19:18868,x04847206,unh cr.ch,UNHCRHQ,SWIGE02,UNHCRHQ,2564,4,ofs,0,0,Inter net.mime{1}
> >>
> >>
> >>>>17:00:39 QUE x04847206,HOP,HubInet,1
> >>>>17:00:39 TRN Hub.Remote,x04847205,3044,50
> >>>>17:00:39 ARR
> >>>>
> >>
>
>>STS,DUREAU,432989E7.B55:13:16097,x04847207,unhcr .ch,UNHCRVENCA,PO,UNHCRHQ,1216,5,ofs,0,5,UNHCRVENC A.PO{1}
> >>
> >>
> >>
> >>>Interesting that there is no immediately obvious date
> >>
> >>
> >>>>I can make educated guesses that 17:00:39 represents a time, ARR means
> >>>>inbound, QUE means queue, TRN - Transfer. The kind of information I need
> >>>>to know is:
> >>>>
> >>>>What log event types exist?
> >>>>What format does each log event have i.e. how are the fields delimited?
> >>
> >>
> >>>It looks like a fairly simple regular expression. I'd have to sit down
> >>>with a script and work out the multiple split character handling but it
> >>>is fairly obviously two colon delimiters to split the three time
> >>>elements. Spaces to delimit the record type then commas for the rest. I
> >>>can see an obvious way to do it with a match and a split in perl or in a
> >>>monolithic regexp match but I'd rather not commit since I'm certain
> >>>there is likely to be a trivialisation possible.
> >>
> >>
> >>>>What does each field represent?
> >>>>What are the limits/rules to each field? e.g. Can ARR be followed by
> >>>>anything other than MSG, STS or ADM?
> >>>>
> >>>>It might be possible, using lots of log files to empirically determine
> >>>>patterns (rules) and make educated guesses as to the field meanings but I
> >>>>was hoping that Novell have documented how their message logging files
are
> >>>>composed. Does anyone have this documentation?
> >>
> >>
> >>>If this is not documented at the support site (either in a TID or
> >>>product documentation) then it is probably not documented. There must be
> >>>some expectation that the log can be used to determine problems so I've
> >>>sent an e-mail message to one of the GroupWise engineers that I know to
> >>>see if I can get some details (absolutely no promises though). In the
> >>>meantime, I believe a few of the GroupWise guys and a few other GW
> >>>experts read these groups so they may beat me to the punch.
> >>
> >>
> >>>>David Mair wrote:
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>>CooperA wrote:
> >>>>>
> >>>>>
> >>>>>
> >>>>>>Hi,
> >>>>>>
> >>>>>>Apologies if this isn't the ideal place to post this question but I was
> >>>>>>advised by Novell Support to begin in the Development section and there
> >>>>>>doesn't appear to be a good match with any of the forums. If you know
of
> >>>>>>a more appropriate forum, please advise.
> >>>>>>
> >>>>>>I've been asked to develop an application that can run through
GroupWise
> >>>>>>6.04 MTA message logging files and collect basic statistics on message
> >>>>>>flow e.g. the total number of messages transferred, their direction and
> >>>>>>destination domain etc.
> >>>>>>
> >>>>>>Can anyone tell me how to interpret these log files? I imagine that
any
> >>>>>>response would entail more than a simple email so hopefully somebody
> >>>>>>somewhere knows of a document that explains the log file format, key
words
> >>>>>>etc. and can point me in the right direction.
> >>>>
> >>>>
> >>>>>If the logs are in a text format then languages like Perl and PHP have
> >>>>>very powerful text analysis capabilities via regular expressions. I use
> >>>>>PHP to distill my web server logs into a MySQL database daily.
> >>>>
> >>>>
> >>>>>If the logs are binary then there is a good chance the format is
> >>>>>undocumented and proprietary I'm afraid.
> >>>>
> >>>>
> >>>>
> >>