Kilburn,
I'm working on the issue of mail logs, and found a problem that causes some traffic to be unaccounted in specific conditions (
http://www.isp-control.net/ispcp/ticket/1345)
There are many issues with this script (It basically works only under special circumstances).
Depending on postfix configuration, localhost could be written "127.0.0.1" in the logs instead of "localhost". And depending on /etc/hosts there could be other variations.
To help me fix this issue (I don't see your problem on my test server), pls send me some <anonymyzed> output from this command:
Code:
#grep postfix /var/log/mail.log|/usr/sbin/maillogconvert.pl standard|grep <relayed_domain.ext>
Also attach an "anonymyzed /etc/hosts".
The solution would be to rewrite the AWK script to:
1. Skip everything with ? bytes (or perhaps account a fixed amount of traffic).
2. Skip anything with virtual delivery (that has been already accounted via SMTP).
3. Account all others (i.e. smtp etc), but take care of antivirus etc properly.
However, once again, I'm running a modified mail flow (not using amavis here) and my logs migh be a little different than yours.
Thank you,
ispcomm.