Splunk for Postfix

Overview

Splunk for Postfix includes dashboards with charts of Message Size, Messages by Status, Real-Time Message Count, Messages by Host, Top Clients, Top Relays, Top Senders, Top Recipients, Max Connection Count, Max Connection Rate, Max Cache Size, Max Simultaneous Connections, Address Lookups, and Domain Lookups
Summary-index-populating searches are scheduled hourly to efficiently report on large volumes of data
Quickly and easily view top delivery reasons, errors by host, and common error codes
Form Searches including Splunk Transactions by Queue ID
Over 20 field extractions, compliant with the Common Information Model
All dashboards use the JSChart module to render graphics. JSChart uses JavaScript to build the graphics for a chart. This provides charting support on platforms such as iOS mobile devices that cannot display Flash-based graphics. The JSChart module also provides better printing quality.
Any feedback, including requests for enhancement are most welcome. Email: luke@verypowerful.info

Screenshots

verypowerful.info

Setup Splunk for Postfix

Splunk for Postfix should work with the following sourcetypes:

syslog
postfix_syslog

Note: ensure that your relevant sourcetype (eg. syslog) is searchable in an index that can be searched by default when no index is specified.

Add an Index to Splunk (REQUIRED):

Create an index called summary_postfix then restart Splunk
- Note: all of the dashboards use searches based on index = summary_postfix (which is populated hourly by summary index searches)

Note: wait ~2 hours for the scheduled searches to start populating the summary_postfix index, and then view the included dashboards :)

Backfill the summary_postfix index (Optional)

Splunk includes the fill_summary_index.py script to backfill gaps in summary index collection by running the saved searches that populate the relevant summary index as they would have been executed at their regularly scheduled times for a given time range. In other words, even though your new summary_postfix index only started collecting data for the last hour, if necessary you can use fill_summary_index.py to fill the summary index with data from the past month.

Reference:

Backfill script

Disclaimer

This app has been created for the specifics of our Postfix environment (Postfix version 2.7.x) and it may or may not suit your specific purposes.

Copyright (c) 2014 Luke Harris. All Rights Reserved.

License

GNU GENERAL PUBLIC LICENSE Version 3

Versions

v1.1.1

added Delivery dashboard

v1.1

updated field extractions
added Errors dashboard

v1.0

initial release (private beta)

Splunk for Postfix

3