Postfix

Download PDF

Rules, dashboards, and triggers for Postfix Mail Server

Overview

Postfix is a popular open-source Mail Transfer Agent (MTA) that routes and delivers electronic mail. Developed as a more secure and easier to administer alternative to Sendmail, Postfix is designed to be fast, easy to administer, and secure. It is widely used on Unix-like systems to route and deliver email.

App Function

  • Parse Postfix syslog messages for delivery status and connection events
  • Extract recipient/sender email addresses, relay servers, and client IPs
  • Categorize events (delivery, delivery_failure, connection, reject, queue)
  • Provide dashboards for monitoring mail flow and delivery issues
  • Alert on bounced emails and relay access denials

Vendor Documentation

Device Configuration

Postfix logs to syslog by default. Configure the syslog daemon to forward mail facility logs to LogZilla:

  1. Edit /etc/rsyslog.conf or create /etc/rsyslog.d/logzilla.conf

  2. Add a forwarding rule:

    text
    mail.*    @logzilla-server:514

  3. Restart rsyslog:

    bash
    systemctl restart rsyslog

Verification

Send a test email and verify events appear in LogZilla with the Vendor tag Postfix. The program field shows the Postfix component, for example smtp, smtpd or qmgr.

Incoming Log Format

text
<date> <hostname> postfix/<service>[<pid>]: <queue_id>: <details> status=<status>
  • date - Timestamp of the log entry
  • hostname - Server generating the log
  • service - Postfix component (smtp, smtpd, qmgr, local, bounce)
  • queue_id - Unique message identifier
  • status - Delivery status (sent, bounced, deferred, expired)

LogZilla recognizes Postfix events by the postfix/ prefix of the syslog tag (postfix/smtp, postfix/smtpd, postfix/qmgr). A relay that rewrites the tag to the bare component name, smtpd instead of postfix/smtpd, must be configured to keep the prefix, or the events arrive untagged. Any syslog name that starts with postfix and ends with /<service>, such as the postfix-out/smtp of a multi-instance setup, is recognized; a program that only contains the word, such as postfixadmin, is not.

Parsed Metadata Fields

Tag NameExampleDescription
VendorPostfixVendor name
ProductMail ServerProduct name
Event ClassNetworkCross-vendor classification (Network or Security)
Event TypeAccess ControlSet on rejected-mail events
Postfix EventdeliveryEvent category (connection, delivery, delivery_failure, queue, reject)
Postfix StatussentDelivery status (sent, bounced, deferred, expired, rejected)
Postfix To[email protected]Recipient address (HC)
Postfix From[email protected]Sender address on delivery, queue and rejected-mail lines (HC)
Postfix Relaysmtp.example.com[192.0.2.1]:25Relay used for delivery, or the relay a delivery attempt could not reach (HC)
SrcIP192.0.2.50Client address on connection, client and rejected-mail lines (HC)

connection covers the connect from, disconnect from and client= lines; queue the queue active, removed and message-id= lines; delivery_failure the bounced, deferred and expired statuses and the unreachable-relay connect to line. Lines the app does not classify, such as the lost connection after and timeout after notices, carry Vendor and Product only.

Dashboards

DashboardPurpose
Postfix: OverviewBounced/deferred/rejected counts, top failed recipients, relay servers

Triggers

TriggerConditionActions
Postfix: Email bouncedstatus=bouncedmark_known, mark_actionable
Postfix: Email deferredstatus=deferredmark_known
Postfix: Relay access deniedreject eventmark_known, mark_actionable, notify

Log Examples

Successful Delivery

text
Jan  1 00:00:00 host1 postfix/smtp[1234]: 1234ABCD: to=<[email protected]>, relay=smtp.example.com[192.0.2.1]:25, status=sent (250 OK)

Bounced Email

text
Feb 28 12:34:56 server-01 postfix/smtp[5678]: 9876ZYXW: to=<[email protected]>, status=bounced (User unknown)

Connection Event

text
Apr 10 08:15:30 mx1 postfix/smtpd[1111]: connect from mail.example.org[198.51.100.50]

Relay Denied

text
May 20 14:22:45 mx1 postfix/smtpd[2222]: NOQUEUE: reject: RCPT from spammer.example.net[203.0.113.99]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<spammer.example.net>

Client Line

text
Jun  2 09:10:11 mx1 postfix/smtpd[3333]: 1234ABCD: client=mail.example.org[198.51.100.50]

Unreachable Relay

text
Jun  2 09:10:12 mx1 postfix/smtp[4444]: connect to mx.example.net[2001:db8::25]:25: Network is unreachable
Postfix | LogZilla Documentation