Logging to two destinations with different log_format and other questions

[Marc Risse]

Hi,

I want to log beside the standard log destination to an additional file with an other log_format. How can I do this without lua skills? I only need time, qid, ip, from, rcpt, action and authenticated and if possible the scores.

Second, I want to ask if someone has an filter example for logstash.

And 3rd, I've two little problems:
I'm managing some local black- and whitelist-mapfiles via Webui. I am able to read and write my files via Webui but on saving the Webui says "Save map error on undefined: Not Found" but it writes the files correct and my changes are working. Any Ideas?

What about spam.abuse.ch? I'm getting this message "error looking up xx.xx.xx.xx.spam.abuse.ch: server fail" for every incoming mail. How can I disable this specific RBL provider? Or is it a local problem?

Sorry for my bad English and thanks for this awesome product!! ;-)

Best
Marc

[Andrew Lewis]

Hi,

> I want to log beside the standard log destination to an additional file
> with an other log_format. How can I do this without lua skills? I only need
> time, qid, ip, from, rcpt, action and authenticated and if possible the
> scores.

Your best recourse is probably to use metadata exporter somehow and
post this information over HTTP:
https://rspamd.com/doc/modules/metadata_exporter.html

> Second, I want to ask if someone has an filter example for logstash.

Someone has integrated Elasticsearch:
https://github.com/Menta2L/rspamd-elastic - that work will likely be
somehow upstreamed at some point. Not aware of what logstash needs but
I'd expect it should be somehow usable with metadata exporter.

> I'm managing some local black- and whitelist-mapfiles via Webui. I am able

> to read and write my files via Webui but on saving the Webui says "*Save
> map error on undefined: Not Found" *but it writes the files correct and my

> changes are working. Any Ideas?

Nope, not really. I don't actually use WebUI.

> What about spam.abuse.ch? I'm getting this message "error looking up
> xx.xx.xx.xx.spam.abuse.ch: server fail" for every incoming mail. How can I
> disable this specific RBL provider? Or is it a local problem?

I don't have problems with it. You can set `disabled = true` or, more
conventionally, `enabled = false` in RBL configuration to disable an
RBL; see example here: https://rspamd.com/doc/modules/rbl.html

Best,
-AL.