Recovering from log file (sendmail)

[Gregory P. Ennis]

On Mon, 2005-05-09 at 18:13 -0600, Ashley M. Kirchner wrote:
>     I've had a mail spooler die on me today and after wrangling NIS+ for 
> a bit, I got a second spooler up and running.  The problem now is that 
> anything between 2AM and 1PM only exists in sendmail's log file (sm-mta) 
> which was on a different machine anyway.  While I don't plan on scouring 
> that file for any messages that have gone missing due to the spooler 
> crashing, I have to wonder: is there some way of actually doing that?
> 
>     There's no hope of recovering the spooler, the drive failed, it 
> won't spin up, it's just dead.  So really anything that came in between 
> 2AM (when the last backup ran) and 1PM (when the spooler died) is 
> sitting in the log file.  Everyone in the building knows they're SOL 
> when it comes to e-mails that arrived in that window, but in the back of 
> my mind I know I can just as well scan that sm-mta log file and yank 
> messages out of it.  I'm just wondering if there's some script floating 
> out there that could possibly help (or am _I_ also SOL? <grin> )
> 


Ashley,

I have a perl script that might do some of it for you but it does not
account for a change of event.  The problem is related to the fact that
successive line items in the log file may be related to different
events.  Each line item is prefixed with an event number so you will
have to keep these straight to pull out a contiguous message.

Good Luck!!

Greg



Gregory P. Ennis <PoMec at PoMec.Net>