Log Formats for Version 3.x

This section documents the log formats used in Momentum version 3.0 and higher.

The mainlog.ec file logs reception, delivery, transient failure, permanent failure and heartbeat events. The log entry format differs depending upon the event type. The different formats are described in the following sections.

E.1.1.1. Reception Records

Every reception that Momentum performs is written to the mainlog.ec file as a single line as shown in the example below.

As with all log file entries, the fields are delimited by @ signs. The fields are:

E.1.1.2. Delivery Records

A delivery line is written to mainlog.ec for every message that is delivered by Momentum. In a cluster configuration, transfers between nodes are also logged.

The log entry is an @ delimited string such as the following:

A description of the fields follows:

E.1.1.3. Transient Failure Records

A transient failure is a failure which allows retry of the same message. The ec_logger module allows for optional logging of transient failures.

A transient failure line is an @ delimited string like the following:

A description of the fields follows:

E.1.1.4. Permanent Failure Records

A permanent failure indicates that the message that was attempted failed in such a way that it should not be retried further. After logging a permanent failure the message will be discarded.

A permanent failure line is an '@' delimited string like the following:

A description of the fields follows:

E.1.1.5. Heartbeat Records

A heartbeat is written periodically to the log, to indicate that Momentum is still active and may log further data. The heartbeats are used by the web console for real-time reporting.

1251470342@@@@M1

A description of the fields follows:

Having three unused fields ensures that, like other logs, the fifth field is the log entry type. This makes parsing easier.

This section documents the rejectlog.ec format. Every rejection that Momentum performs is written to the rejectlog.ec file as a single line as shown in the following example:

In this case, the fields are delimited by spaces. The fields are:

The rejectlog.ec file also has heartbeat entries in the following format:

1252064908: Marker 1

The "Marker 1" entry follows the Unix timestamp and is separated from it by a space.

The acctlog.ec log contains both authentication entries and authorization entries for the SMTP and Control Listeners. For more information on configuring listeners for logging authentication and authorization events see “Authentication, Authorization and Accounting”.

E.1.3.1. Authentication Records

If enabled for the listener, authentication events for Unix domain sockets are logged one per line as shown below:

1160503808@N@/tmp/2025@@ec-user@1

If enabled for the listener, authentication events for TCP/IP listeners are logged one per line as shown below:

1160172232@N@*:2025@10.80.116.126:37164@ec_user@1

The fields are delimited by @ signs. @, \, \n and other control characters appearing in a field are escaped by adding an \ before them. The fields are:

E.1.3.2. Authorization Records

A line is written to acctlog.ec for every authorization event. The line is an @ delimited string. @, \, \n and other control characters appearing in a field are escaped by adding an \ before them.

Authorization entries might look like the following:

A description of the fields follows:

The ‘T’ type indicator denotes an authentication timeout and the ‘?’ type indicator denotes an unknown acctlog type.

You can record the outcome of a spool import operation (see spool import) by configuring a path for the importlog. To do this add the following line to the ec_logger module:

By default no log rotation is performed for the importlog.

The format for the importlog is:

bounce_logger writes a single logfile, bouncelog.ec, which records both in-band (or protocol-time) and out-of-band bounces. The format was designed to be a concise, machine-parseable, computationally inexpensive and complete format for writing information about every bounce message.

E.1.5.1. The bounce_logger Format

The bouncelog.ec file logs bounces and heartbeats. The log entry format differs depending upon the event type.

E.1.5.1.1. Bounce Records

Every bounce that Momentum witnesses is written to the bouncelog.ec file as a single line as show in the example below. (this example has been wrapped for display purposes; it will be a single line in the log file).

As in all ec_logger-formatted entries, the fields are delimited by @ signs. The fields are:

The bounce logs also have heartbeat entries in the following format:

1251222268@@@@M1

A description of the fields follows:

Having three unused fields ensures that, like other logs, the fifth field is the log entry type. This makes parsing easier.

E.1.5.1.2. Bounce Classification Codes

The bounce classification codes are identical for all versions of Momentum. For a list of the codes and their meanings see “Bounce Classification Codes”.