NAME

Parse::Syslog::Mail - Parse mailer logs from syslog

VERSION

Version 0.17

SYNOPSIS

    use Parse::Syslog::Mail;

    my $maillog = Parse::Syslog::Mail->new('/var/log/syslog');
    
    while(my $log = $maillog->next) {
        # do something with $log
        # ...
    }

DESCRIPTION

As its names implies, "Parse::Syslog::Mail" presents a simple interface to gather mail information from a syslog file. It uses "Parse::Syslog" for reading the syslog, and offer the same simple interface. Currently supported log formats are: Sendmail, Postfix, Qmail.

METHODS

new(): Creates and returns a new "Parse::Syslog::Mail" object. A file path or a "File::Tail" object is expected as first argument. Options can follow as a hash. Most are the same as for "Parse::Syslog->new()".
Options

"type" - Format of the syslog stream. Can be one of "syslog" (traditional syslog format) or "metalog" (Metalog format).
"year" - Syslog files usually do store the time of the event without year. With this option you can specify the start-year of this log. If not specified, it will be set to the current year.
"GMT" - If this option is set, the time in the syslog will be converted assuming it is GMT time instead of local time.
"repeat" - "Parse::Syslog" will by default repeat xx times events that are followed by messages like "last message repeated xx times". If you set this option to false, it won't do that.
"locale" - Specifies an additional locale name or the array of locale names for the parsing of log files with national characters.
"allow_future" - If true will allow for timestamps in the future. Otherwise timestamps of one day in the future and more will not be returned (as a safety measure against wrong configurations, bogus "year" arguments, etc.)

Example

    my $syslog = new Parse::Syslog::Mail '/var/log/syslog', allow_future => 1;

next(): Returns the next line of the syslog as a hashref, or "undef" when there is no more lines. The hashref contains at least the following keys:

"host" - hostname of the machine.
"program" - name of the program.
"timestamp" - Unix timestamp for the event.
"id" - Local transient mail identifier.
"text" - text description.

Other available keys:

"from" - Email address of the sender.
"to" - Email addresses of the recipients, coma-separated.
"msgid" - Message ID.
"relay" - MTA host used for relaying the mail.
"status" - Status of the transaction.
"delivery_type" - (Qmail only) type of the delivery: "local" or "remote".
"delivery_id" - (Qmail only) id number of the delivery.

Example

    while(my $log = $syslog->next) {
        # do something with $log
    }

DIAGNOSTICS

"Can't create new %s object: %s": (F) Occurs in "new()". As the message says, we were unable to create a new object of the given class. The rest of the error may give more information.
"Expected an argument": (F) You tried to call "new()" with no argument.

TODO

Add support for other mailer daemons (Exim, Courier, Qpsmtpd). Send me logs or, even better, patches, if you want support for your favorite mailer daemon.

AUTHOR

Sébastien Aperghis-Tramoni "<sebastien (at) aperghis.net>"

BUGS

Please report any bugs or feature requests to "bug-parse-syslog-mail (at) rt.cpan.org", or through the web interface at <https://rt.cpan.org/NoAuth/Bugs.html?Dist=Parse-Syslog-Mail>. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

CAVEATS

Most probably the same as "Parse::Syslog", see "BUGS" in Parse::Syslog

COPYRIGHT & LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.