Setting up a Lire responder (Log Analyzer)

Install the software

Log in on the Ubuntu machine, and install said packages: sudo apt-get install lire postfix fetchmail apache2 dovecot-common emacs ^{[20] [21]}

Now also install some Perl modules:

Configure PostScript

1. Make it a satellite system

   First, configure PostFix it as a satellite system with a smarthost. You can use dpkg-reconfigure postfix to re-run the configuration process if you haven't already configured it like that in the previous step. Add the following line to /etc/postfix/main.cf to enable maildir-style mailboxes:

     mail_spool_directory = /var/mail/
   	    

   Then restart postfix: sudo /etc/init.d/postfix/restart

   Also (standard good practice) edit /etc/aliases to send root mail to a real person. While you're at it, create a couple of maildirs 'accounts' in /etc/aliases too:

   apache2:       /var/spool/lire/apache2/Maildir/
   postfix:       /var/spool/lire/postfix/Maildir/
   	    

   Don't forget to run postalias on that file.

2. Create the log maildirs

   Now also create the maildirs, and give ownership to nobody, the user as which Postfix delivers mail.

   	Warning
   	ToDo: create an actual system account especially for this

   sudo mkdir -p /var/spool/lire/{postfix,apache2}/Maildir/{tmp,new,cur}
sudo chown -R nobody /var/spool/lire/*

3. Test the log maildirs

   Now send a mail from a local account and see whether PostFix delivers it below /var/spool/lire/apache2/. If not, tail /var/log/mail.log for hints.

   echo "blah"|mailx -s test2 apache2@localhost
find /var/spool/lire/
/var/spool/lire/apache2/
/var/spool/lire/apache2/cur
/var/spool/lire/apache2/tmp
/var/spool/lire/apache2/new
/var/spool/lire/apache2/new/1236899044.V808I238b2M333495.cit-zb-13-81

   After a while, this shows up in /var/log/mail.log:

   all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/dbmail/Maildir/new/
all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/watchguard/Maildir/new/
all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/iis_ftp/Maildir/new/
all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/cups_pagelog/Maildir/new/
bogus message: Can't locate package Exporter for @Lire::Config::Build::ISA at /usr/share/perl5/Lire/Config.pm line 7.
bogus message: Undefined subroutine &Lire::Config::ac_info called at /usr/share/perl5/Lire/Config.pm line 50.
bogus message: BEGIN failed--compilation aborted at /usr/share/perl5/Lire/Program.pm line 174.
bogus message: Compilation failed in require at /usr/share/lire/lib/lire/lr_getbody line 10.
bogus message: BEGIN failed--compilation aborted at /usr/share/lire/lib/lire/lr_getbody line 10.
all postfix lr_tag-20090313070738-22471 lr_processmail warning lr_getbody didn't completed successfully
all postfix lr_tag-20090313070738-22471 lr_processmail err No submitter can be found. Keeping /tmp/lr_processmail.postfix.lr_tag-20090313070738-22471.nvBgom.mail for debugging
all all lr_tag-20090313070738-22471 lr_spool err lr_processmail postfix on file '/tmp/1236924314.V808I238b4M604047.cit-zb-39-54' failed, moving to /var/lib/lire/data/email/raw/failed
bogus message: mv: cannot move `/tmp/1236924314.V808I238b4M604047.cit-zb-39-54' to `/var/lib/lire/data/email/raw/failed': No such file or directory

Test basic Lire functionality

1. Run the lr_spoold daemon

   Start the responder manually: sudo lr_run lr_spoold& (Later on, we're going to create an initscript for this).

2. Send a local test log for analysis

   Send the local postfix log to the analyzer to see if it reacts: cat /var/log/mail.log |mailx -s postfix-analysis-test postfix@localhost

   	Note
   	The log analyzer is a cron kind of thing, so reactionmay not be immediate. Be patient.

   	Note
   	Whether the results show up in your mailbox on the system on the system at hand or somewhere else of course depends on whether you properly configured an alias for yourself.