AMAVIS-LOGWATCH(1)

🎀 amavis-logwatch(1) 💅

General Commands Manual 🌸

---

✨ NAME ✨

amavis-logwatch - An Amavisd-new log parser and analysis utility 💖

🦋 SYNOPSIS 🦋

amavis-logwatch [options] [logfile ...]

💖 DESCRIPTION 💖

okay bestie, so amavis-logwatch(1) is an Amavisd-new log parser 🧚 that cooks up summaries, details, and statistics about how Amavisd-new is running (we'll just call it Amavis from here on, periodt ✨).

It can run as a standalone program, or as a Logwatch filter module so you get Amavisd-new summary and detailed reports right inside Logwatch 🫶

This thing can make a wide range of reports, and the data is grouped and sorted as much as possible so there's less noise and the patterns actually pop 🔥 The brief summary reports give you the quick vibe check on general Amavis operations and message delivery, and they call out any warnings that might need your attention 👀 The detailed reports are hierarchically arranged and super easy to scan, with as much or as little detail as you want 💅

Most of the good stuff only shows up when Amavis' $log_level is set to at least 2. See Amavis Log Level below.

So the output has two main sections: a Summary section and a Detailed section 🌈 For readability, every event or hit count sits in the left column, then comes a short description of the event type, and then any extra stats or count representations get tucked into the rightmost column 💜

Here's a segment from a sample Summary report so you can see the vibe:

****** Summary ********************************************

       9   Miscellaneous warnings

   20313   Total messages scanned ----------------  100.00%
1008.534M  Total bytes scanned                1,057,524,252
========   ================================================

    1190   Blocked -------------------------------    5.86%
      18     Malware blocked                          0.09%
       4     Banned name blocked                      0.02%
     416     Spam blocked                             2.05%
     752     Spam discarded (no quarantine)           3.70%

   19123   Passed --------------------------------   94.14%
      47     Bad header passed                        0.23%
   19076     Clean passed                            93.91%
========   ================================================

      18   Malware -------------------------------    0.09%
      18     Malware blocked                          0.09%

       4   Banned --------------------------------    0.02%
       4     Banned file blocked                      0.02%

    1168   Spam ----------------------------------    5.75%
     416     Spam blocked                             2.05%
     752     Spam discarded (no quarantine)           3.70%

   19123   Ham -----------------------------------   94.14%
      47     Bad header passed                        0.23%
   19076     Clean passed                            93.91%
========   ================================================

    1982   SpamAssassin bypassed
      32   Released from quarantine
       2   DSN notification (debug supplemental)
       2   Bounce unverifiable
    2369   Whitelisted
       2   Blacklisted
      12   MIME error
      58   Bad header (debug supplemental)
      40   Extra code modules loaded at runtime

Okay so reading that report 🤓 it says there were 9 general warnings, and Amavis scanned a total of 20313 messages, which adds up to 1008.53 megabytes or 1,057,524,252 bytes 📊 Next up is the Blocked / Passed overview: 1190 messages got blocked (18 as malware, 4 with banned names, 416 spam messages, and 752 discarded), and 19123 got passed (47 with bad headers and 19076 clean ones) 😭

The next grouping (it's optional) shows message disposition by contents category. So there were 18 malware messages and 4 banned file messages, all blocked 🙅‍♀️ There were 1168 Spam messages, and 416 of those were blocked (quarantined) while 752 got discarded. Lastly, there were 19123 messages considered Ham (aka not spam), and 47 of those had bad headers 🫠

Tons of other count summaries for different events show up too 🍓

There are dozens of sub-sections in the Detailed report, and you can control the output of each one in different ways 🧚 Every sub-section tries to group and present the most meaningful data at the higher levels, and shoves the less useful or noisy stuff down to the lower levels 🌸 The whole point is to get as much value as possible out of smart grouping, so you can scan faster, spot patterns, and actually solve problems 💖 Data is always sorted in descending order by count, and then either numerically by IP address or alphabetically, whichever makes more sense 🎀

This Spam blocked segment from a sample Detailed report shows the basic hierarchy levels of amavis-logwatch:

****** Detailed *******************************************

   19346   Spam blocked -----------------------------------
     756      from@example.com
        12         10.0.0.2
        12            <>
        12         192.168.2.2
        12            <>
         5         192.168.2.1
     ...

So amavis-logwatch reads from STDIN or from the Amavis logfile you name 📜 You can give it multiple logfile arguments, and they get processed in order ✨ Just make sure whoever is running amavis-logwatch has read permission on every log file you name 🔒

💖 Options 💖

These options change how amavis-logwatch behaves 🎀 If you give the same option twice, the one that comes later on the command line wins 👑 Also, any option can be abbreviated as long as the shortened version is unambiguous 💅

• --[no]autolearn, --show_autolearn boolean — turns the autolearn report on (or off) 🧠 This report only works if the default Amavis $log_templ has been changed so the log entries include autolearn results 🙈 You can do that by uncommenting two lines in the Amavis program itself (that's where the default log templates live), or by properly adding the $log_templ variable to the amavisd.conf file. Check out Amavis' README.customize, and search near the end of the Amavisd program for "autolearn" 🔍
• --[no]by_ccat_summary, --show_by_ccat_summary boolean — turns the by contents category summary in the Summary section on or off 🌈 Default: enabled.
• -f config_file, --config_file config_file — uses a different config file, config_file, instead of the default one 🧚 You can use this option more than once, and the config files get processed in the order you put them on the command line. See CONFIGURATION FILE below.
• --debug keywords — prints debug info while amavis-logwatch is running 🐛 The keywords value is one or more keywords separated by commas or spaces. To see the list of valid keywords, use --debug xxx, where xxx is any keyword that isn't valid 😭
• --detail level — sets the maximum detail level to level 💖 This one is global, so it overrides any of the other output limiters we'll get to below. The Summary section always gets made, and with a level under 5, that's the only section you'll get. At level 5 and up, the Detailed section and any additional report sections can show up in the output. Every time the level goes up, you get one more hierarchical sub-level in the Detailed section, and at level 10 you get them all 🌸 Lines longer than the maximum report width (set with max_report_width) will get cut. If you set level to 11, nothing in the report gets cut (see also --line_style) 🦋
• --[no]first_recip_only, --show_first_recip_only boolean — decides whether you sort by and show only the first recipient when one scanned message has multiple recipients 💌
• --help — prints usage info and a quick description of the command line options 🙋‍♀️
• --ipaddr_width width — prints IP addresses in address/hostname pairs with a field width of width characters 📏 Making this bigger can help if your system has long IPv6 addresses 🌐
• -l limiter=levelspec, --limit limiter=levelspec — sets the level limiter limiter to the specification levelspec 🎯
• --line_style style — tells it how to handle long report lines 📜 There are three styles: full, truncate, and wrap. Setting style to full stops lines from being cut at max_report_width, which is what happens automatically when detail is 11 or higher ✨ truncate is the default, and that means long lines get cut according to max_report_width 🔪 Setting style to wrap wraps lines longer than max_report_width, but in a way that keeps the left column hit counts from getting hidden 💖 This option beats the line style that the detail level would otherwise imply. And just so you know, --full, --truncate, and --wrap are synonyms for these 💅
• --nodetail — turns off the Detailed section and all the supplemental reports 🧹 It's a handy way to clear out every Detailed section at once, and then any options you put after it can switch back on whichever sections you want, so you can build a specific report 🍓
• **--sarules S,H´, --sarules default** — turns on the SpamAssassin Rules Hit report 🔥 The comma-separated SandHvalues are the top N values for the Spam and Ham reports, respectively. They can be any integer greater than or equal to 0, or the keywordall💜 The keyworddefault` uses the built-in default values ✨
• --nosarules — turns off the SpamAssassin Rules Hit report 🙅‍♀️
• --sa_timings nrows — turns on the SpamAssassin Timings percentiles report ⏱️ You can cap it to the top N rows with the nrows argument. Heads up that this report needs Amavis 2.6+ and SpamAssassin 3.3+ 🫶
• **--sa_timings_percentiles P1 [P2 ...]´** — picks which percentiles show up in the SpamAssassin Timings report 📈 The P1 ...` arguments are integers from 0 to 100 inclusive, and they keep the order you gave them in the report 🦋
• --nosa_timings — turns off the SpamAssassin Timings report 🌸
• --version — okay bestie, this one just spills the tea on which amavis-logwatch version you're running ✨
• --score_frequencies B1 [B2 ...]´ / --score_frequencies default — turns on the Spam Score Frequency report 📊 The B1 ... args are frequency distribution buckets and they can be any real numbers 🔢 Their order is kept in the report, so your buckets stay in the order you typed them 💅 The default keyword just uses the built-in default values 🎀
• --noscore_frequencies — shuts the Spam Score Frequency report off 🙅‍♀️
• --score_percentiles P1 [P2 ...]´ / --score_percentiles default — turns on the Spam Score Percentiles report 💜 The P1 ... args pick which percentiles show up, and they have to be integers from 0 to 100 inclusive 🧚 The default keyword uses the built-in default values.
• --noscore_percentiles — disables the Spam Score Percentiles report 🥀
• --[no]sect_vars, --show_sect_vars boolean — enables (or disables) tacking the level limiter's name onto each Detailed section title 🔍 The name that shows up is the command line option (or configuration file variable) that limits that section's output. With so many level limiters around, this is a super convenient way to figure out exactly which one is messing with a section 🫶
• --[no]startinfo, --show_startinfo boolean — enables (or disables) the Amavis startup report, which shows the most recent Amavis startup details 🚀
• --[no]summary, --show_summary — enables (or disables) showing the Summary section of the report 📝 In a configuration file, the variable Amavis_Show_Summary is the one you use.
• --syslog_name namepat — tells amavis-logwatch which syslog service name to look for when it matches syslog lines 🎯 Only log lines whose service name matches the perl regular expression namepat get used. Everything else is silently ignored 🙈 This is clutch when a pre-installed Amavis package uses a name other than the default (amavis) 📦

Note: if you use parentheses in your regular expression, make sure they're cloistering and not capturing. Use (?:pattern) instead of (pattern) 🙏

• --timings percent — enables the Amavis Scan Timings percentiles report ⏱️ You can top N-percent limit it with the percent argument 👑
• --timings_percentiles P1 [P2 ...]´ — picks the percentiles shown in the Scan Timings report 📈 The P1 ... args are integers from 0 to 100 inclusive, and their order is preserved in the report 🌸
• --notimings — disables the Amavis Scan Timings report 💀
• --version — okay bestie, this one just spills the tea on which amavis-logwatch version you're running ✨

---

🦋 Level Limiters 🦋

The output of every section in the Detailed report is controlled by a level limiter 💅 The name of the level limiter variable gets printed whenever the sect_vars option is set 🌈 You can set limiters from the command line in standalone mode with --limit limiter=levelspec, or from a configuration file with the variable $amavis_limiter=levelspec ⭐ Every limiter needs a levelspec argument, which is explained below in LEVEL CONTROL.

Here's the full list of level limiters 🎀

Amavis major contents category (ccatmajor) sections, listed in order of priority: VIRUS, BANNED, UNCHECKED, SPAM, SPAMMY, BADH, OVERSIZED, MTA, CLEAN.

• MalwareBlocked, MalwarePassed — blocked or passed messages that contain malware 🦠 (ccatmajor: VIRUS).
• BannedNameBlocked, BannedNamePassed — blocked or passed messages with banned names in MIME parts 🚫 (ccatmajor: BANNED).
• UncheckedBlocked, UncheckedPassed — blocked or passed messages that never got checked by a virus scanner or SpamAssassin 🙈 (Amavis ccatmajor: UNCHECKED).
• SpamBlocked, SpamPassed — blocked or passed messages that were considered spam and hit kill level 🔥 (Amavis ccatmajor: SPAM).
• SpammyBlocked, SpammyPassed — blocked or passed messages that were considered spam but didn't reach kill level 🫠 (Amavis ccatmajor: SPAMMY).
• BadHeaderBlocked, BadHeaderPassed — blocked or passed messages with bad mail headers 🤨 (ccatmajor: BAD-HEADER).
• OversizedBlocked, OversizedPassed — blocked or passed messages that were considered oversized 🐘 (Amavis ccatmajor: OVERSIZED).
• MtaBlocked, MtaPassed — blocked or passed messages because they failed to re-inject to the MTA 📬 (Amavis ccatmajor: MTA-BLOCKED). Occurrences of this event mean there's a configuration problem ⚠️

[ note: I don't believe mtapassed occurs, but exists for completeness.]

• OtherBlocked, OtherPassed — blocked or passed messages that don't fall into any of the other major contents categories 🧩 (Amavis ccatmajor: OTHER).
• TempFailBlocked, TempfailPassed — blocked or passed messages that had a temporary failure ⏳ (Amavis ccatmajor: TEMPFAIL).
• CleanBlocked, CleanPassed — blocked or passed messages that were considered clean 🧼 (Amavis ccatmajor: CLEAN; i.e. non-spam, non-viral).

🌸 Other sections, arranged alphabetically 🌸

• AvConnectFailure — problems connecting to Anti-Virus scanner(s) 🔌
• AvTimeout — timeouts while waiting on responses from Anti-Virus scanner(s) ⌛
• ArchiveExtract — archive extraction problems 📦
• BadHeaderSupp — supplemental debug info about messages with bad mail headers 🕵️
• Bayes — message frequencies sorted into Bayesian probability buckets 🪣
• BadAddress — invalid mail address syntax 💌
• Blacklisted — messages that were (soft-)blacklisted 🖤 See also Whitelisted below.
• BounceKilled, BounceRescued, BounceUnverifiable — what happened to incoming bounce messages (DSNs) 🏀
• ContentType — MIME attachment breakdown by type/subtype 🗂️
• DccError — errors encountered with or returned by DCC 🐛
• DefangError — errors encountered during the defang process 🪄
• Defanged — messages that got defanged (rendered harmless) 🧸
• DsnNotification — errors encountered while trying to send a delivery status notification 📨
• DsnSuppressed — delivery status notifications (DSNs) that were intentionally suppressed 🤫
• ExtraModules — extra code modules Amavis loaded during runtime 🧩
• FakeSender — forged sender addresses, as determined by Amavis 🎭
• Fatal — fatal events 💀 These get presented at the top of the report, since they may need attention right away.
• LocalDeliverySkipped — failures delivering to a local address 🏠
• MalwareByScanner — a breakdown of malware by whichever scanner(s) caught it 🔎
• MimeError — errors encountered during MIME extraction 🧵
• Panic — panic events 😱 These get presented at the top of the report, since they may need attention right away.
• p0f — passive fingerprint (p0f) hits, grouped by mail contents type (virus, unchecked, banned, spam, ham), then by operating system genre, and finally by IP address 🖥️ Note: Windows systems get refined by Windows OS version, while versions of other operating systems are grouped generically.
• Released — messages that were released from Amavis quarantine 🕊️
• SADiags — diagnostics reported by SpamAssassin 🧠
• SmtpResponse — SMTP responses received during the dialog with the MTA 💬 These log entries are mainly debug.
• TmpPreserved — temporary directories that Amavis preserved when some component ran into a problem or failure 📁 Check the listed directories and their corresponding log entries for problems 🔍
• VirusScanSkipped — messages that a virus scanner couldn't scan 🙅‍♀️
• Warning — warning events that don't fall under the specific warnings below ⚠️ These get presented at the top of the report, since they may need attention.
• WarningAddressModified — incomplete email addresses that Amavis modified for safety 🛡️
• WarningNoQuarantineId — attempts to release a quarantined message that didn't have an X-Quarantine-ID header 🫣
• WarningSecurity levelspec — insecure configuration or utility being used by Amavis 🔐
• WarningSmtpShutdown — failures during the SMTP conversation with the MTA 🔌
• WarningSql — failures to communicate with the SQL service, or error replies from it 🗄️
• Whitelisted — messages that were (soft-)whitelisted 🤍 See also Blacklisted above.

✨ LEVEL CONTROL ✨

okay bestie, the Detailed section is basically a bunch of sub-sections 🌸, and each one can be controlled both globally AND independently 💅. Two settings decide what shows up in the Detailed report:

• a global detail level (set with --detail), which is the big hammer 🔨💖 and has the final say over the whole Detailed section
• sub-section specific detail settings, which are the small hammer 🔨 and let you trim the output even more for just one sub-section

Each sub-section can be capped at a certain depth level, and each sub-level can be limited with a top N or a threshold 🦋. The levelspec argument to each of the level limiters above is what makes all of that happen ✨.

It's probably best to keep going with sub-level limiting using this well-known outline-style hierarchy, plus some basic examples 🧚:

level 0
   level 1
      level 2
         level 3
            level 4
            level 4
      level 2
         level 3
            level 4
            level 4
            level 4
         level 3
            level 4
         level 3
   level 1
      level 2
         level 3
            level 4

The simplest form of output limiting suppresses all output below a specified level. For example, a levelspec set to "2" shows only data in levels 0 through 2. Think of it like collapsing each level 2 item 🫶, hiding all the inferior levels (3, 4, ...), which gives you:

level 0
   level 1
      level 2
      level 2
   level 1
      level 2

Sometimes the output gets way too much 😭, and it's useful to suppress any data that doesn't exceed a certain threshold value. Imagine a dictionary spam attack 💀, which produces super long lists of hit-once recipient email or IP addresses. Each sub-level in the hierarchy can be threshold-limited by setting the levelspec appropriately. Setting levelspec to the value "2::5" will suppress any data at level 2 that does not exceed a hit count of 5.

Maybe you want a top N list, like the top 10 senders 👑. A levelspec of "3:10:" limits level 3 data to only the top 10 hits.

With those simple examples out of the way, a levelspec is defined as a whitespace- or comma-separated list of one or more of the following:

• l — sets the maximum level to be output for this sub-section, from 0 to 10. If l is 0, no levels get output, which effectively disables the sub-section. (Level 0 data is already in the Summary report, so level 1 is the first useful level in the Detailed report 🌈.) Higher values output everything up to and including the specified level.
• l.n — same as above, but with the bonus that n limits this section's level 1 output to the top n items. n can be any integer greater than 1. (Honestly this one has less utility than the syntax below 🙄. It's only here for backwards compatibility, so users are encouraged to use the syntax below instead 💜.)
• l:n:t — a triplet that sets level l, top n, and minimum threshold t. They're all integers: l is the level limiter we talked about, n is the top n limiter for level l, and t is the threshold limiter for level l. If you specify both n and t, n wins 👑, so you can make top N lists regardless of the threshold value. If l is left out, the values for n and/or t get applied to all levels available in the sub-section. That's a simple form of wildcarding (eg. slap a minimum threshold on every level 💅). Specific limiters always beat wildcard limiters though. The first form of level limiter can be included in levelspec to restrict output no matter how many triplets are present.

All three forms of limiters only work when amavis-logwatch's detail level is 5 or greater (the Detailed section doesn't even turn on until detail is at least 5) 🙈.

See the EXAMPLES section for usage scenarios 🎀.

---

✨ CONFIGURATION FILE ✨

amavis-logwatch can read settings from a configuration file 📝. Basically any command line option can go in there, and those settings get read when it starts up 🚀.

Because amavis-logwatch can run standalone OR inside Logwatch, it inherits Logwatch's configuration file syntax requirements and conventions so nobody gets confused 🫶. Here's the vibe:

• White space lines are ignored.
• Lines beginning with # are ignored
• Settings are of the form:

option = value

• Spaces or tabs on either side of the = character are ignored.
• Any value protected in double quotes will be case-preserved.
• All other content is reduced to lowercase (non-preserving, case insensitive).
• All amavis-logwatch configuration settings must be prefixed with "$amavis_" or amavis-logwatch will ignore them 🙅.
• When running under Logwatch, any values not prefixed with "$amavis_" are consumed by Logwatch. It only passes along settings it considers valid, via environment variable.
• The values True and Yes are converted to 1, and False and No are converted to 0.
• Order of settings is not preserved within a configuration file 🌀. (Settings are passed by Logwatch via environment variables, which have no defined order.)

To include a command line option in a configuration file, prefix the command line option name with the word "$amavis_". The following configuration file setting and command line option are equivalent ✨:

$amavis_Line_Style = Truncate

--line_style Truncate

Level limiters are also prefixed with $amavis_, but on the command line they're specified with the --limit option 🦋:

$amavis_SpamBlocked = 2

--limit SpamBlocked=2

The order of command line options and configuration file processing goes like this 📋:

1. The default configuration file is read if it exists and no --config_file was specified on a command line.
2. Configuration files are read and processed in the order found on the command line.
3. Command line options override any options already set either via command line or from any configuration file.

Command line options are interpreted when they're seen on the command line, and later options override previously set options. main character energy 👑

---

✨ EXIT STATUS ✨

The amavis-logwatch utility exits with a status code of 0 unless an error occurred 😱. If something goes wrong, a non-zero exit status gets returned 💔.

✨ EXAMPLES ✨

🏃 Running Standalone

Okay so bestie, amavis-logwatch can read its log data from one or more named Amavis log files, or straight from STDIN 💅. To keep things short, the examples use the word file to mean /path/to/amavis.log. Obviously you swap file out for your real path 🫶.

To run amavis-logwatch in standalone mode, just run:

amavis-logwatch file

Want the full menu of options and basic usage? Hit this:

amavis-logwatch --help

To print a summary-only report of Amavis log data:

amavis-logwatch --detail 1 file

To get a summary report plus a one-level detail report for May 25th:

grep 'May 25' file | amavis-logwatch --detail 5

Need just a top 10 list of Sent email domains? Then the summary and detailed reports have to get turned off first 🙈. Command line options are read and enabled left-to-right, so the Sent section gets re-enabled to level 1 with a level 1 top 10 limiter 💖:

amavis-logwatch --nosummary --nodetail \
   --limit spamblocked '1 1:10:' file

Here's a spicier level limiter example 🌶️. This one gives the top 4 spam blocked recipients (level 1). Under each recipient it shows the top 2 sending IPs (level 2), and then below that, only envelope from addresses (level 3) with hit counts greater than 6. The little ... ellipses mean the data got cut off by a top N or threshold limit 🦋:

amavis-logwatch --nosummary --nodetail \
        --limit spamblocked '1:4: 2:2: 3::6' file

Here's what that sample output looks like:

19346   Spam blocked -----------------------------------
  756      joe@example.com
   12         10.0.0.1
   12            <>
   12         10.99.99.99
   12            <>
          ...
  640      fred@example.com
    8         10.0.0.1
    8            <>
    8         192.168.3.19
    8            <>
          ...
  595      peter@sample.net
    8         10.0.0.1
    8            <>
    7         192.168.3.3
    7            <>
          ...
  547      paul@example.us
    8         192.168.3.19
    8            <>
    7         10.0.0.1
    7            <>
            ...
          ...

🚂 Running within Logwatch

Heads up, bestie 🎀: Logwatch versions prior to 7.3.6, unless configured otherwise, needed the --print option to print to STDOUT instead of sending reports via email. Since version 7.3.6, STDOUT is the default output destination, and the --print option has been replaced by --output stdout. Check your configuration to see where report output is going, then add the right option to the commands below.

To print a summary report for today's Amavis log data:

logwatch --service amavis --range today --detail 1

To print a report for today's Amavis log data, with one level of detail in the Detailed section:

logwatch --service amavis --range today --detail 5

To print a report for yesterday, with two levels of detail in the Detailed section:

logwatch --service amavis --range yesterday --detail 6

To print a report from Dec 12th through Dec 14th, with four levels of detail in the Detailed section:

logwatch --service amavis --range \
        'between 12/12 and 12/14' --detail 8

To print a report for today, with all levels of detail:

logwatch --service amavis --range today --detail 10

Same as above, but leaves long lines uncropped:

logwatch --service amavis --range today --detail 11

📜 Amavis Log Level

Amavis gives you extra log info when the variable $log_level is increased above the default 0 value. amavis-logwatch uses that info to build additional reports that aren't available with the default $log_level=0 value. A $log_level of 2 is suggested 🌸.

If you'd rather not crank up the noise in your main mail or Amavis logs, you can set up syslog to send Amavis' output to multiple log files. Basic log entries get routed to your main mail log(s), and the more detailed entries get routed to an Amavis-specific log file that feeds the amavis-logwatch utility 🧚.

A convenient way to do this is to change the Amavis configuration variables in amavisd.conf as shown below:

amavisd.conf:
    $log_level = 2;
    $syslog_facility = 'local5';
    $syslog_priority = 'debug';

This bumps $log_level to 2, and sends Amavis' log entries to an alternate syslog facility (eg. local5, user). From there, they can be routed to one or more log files, including your main mail log file ✨:

syslog.conf:
    #mail.info                         -/var/log/maillog
    mail.info;local5.notice            -/var/log/maillog

    local5.info                        -/var/log/amavisd-info.log

Amavis' typical $log_level 0 messages will go to both your maillog and the amavisd-info.log file. Higher $log_level messages only get routed to the amavisd-info.log file 👑. For more info on Amavis' logging, search the file RELEASE_NOTES in the Amavis distribution for:

"syslog priorities are now dynamically derived"

---

✨ ENVIRONMENT ✨

The amavis-logwatch program uses the following (automatically set) environment variables when it's running under Logwatch 💜:

• LOGWATCH_DETAIL_LEVEL — This is the detail level set with the Logwatch command line argument --detail, or the Detail setting in the ...conf/services/amavis.conf configuration file.
• LOGWATCH_DEBUG — This is the debug level set with the Logwatch command line argument --debug.
• amavis_xxx — Logwatch passes all the amavis_xxx settings in the ...conf/services/amavis.conf configuration file to the amavis filter (which is actually named .../scripts/services/amavis) through an environment variable.

---

✨ FILES ✨

Standalone mode

• /usr/local/bin/amavis-logwatch — The amavis-logwatch program
• /usr/local/etc/amavis-logwatch.conf — The amavis-logwatch configuration file in standalone mode

Logwatch mode

• /etc/logwatch/scripts/services/amavis — The Logwatch amavis filter
• /etc/logwatch/conf/services/amavis.conf — The Logwatch amavis filter configuration file

---

✨ SEE ALSO ✨

• logwatch(8) — system log analyzer and reporter

✨ README FILES ✨

• README — an overview of amavis-logwatch
• Changes — the version change list history
• Bugs — a list of the current bugs or other inadequacies
• Makefile — the rudimentary installer
• LICENSE — the usage and redistribution licensing terms

✨ LICENSE ✨

Covered under the included MIT/X-Consortium License: http://www.opensource.org/licenses/mit-license.php 🦋

✨ AUTHOR(S) ✨

Mike Cappella 👑

The original amavis Logwatch filter was written by Jim O'Halloran, and it's had lots of contributors over the years 🌈. Those folks are entirely NOT responsible for any errors, problems or failures since the current author's hands have touched the source code 💀.

---

That's the whole page, bestie! 💖 Signing off with AMAVIS-LOGWATCH(1) 🫶✨