postfix-logwatch: NOQUEUE prefix for abnormal connection terminations

In postfix-3.10.0, these lines gained a "NOQUEUE: " prefix:

  https://www.postfix.org/announcements/postfix-3.10.0.html

To support both formats, we strip the prefix early on, and then do
what we used to do. For reference, the full list of reasons can be
found in the postfix source, in src/smtpd/smtpd.c:

   /*
    * Reasons for losing the client.
    */
  #define REASON_TIMEOUT          "timeout"
  #define REASON_LOST_CONNECTION  "lost connection"
  #define REASON_ERROR_LIMIT      "too many errors"

diff --git a/postfix-logwatch b/postfix-logwatch
old mode 100644 (file)
new mode 100755 (executable)
index cc37b87..d7a363b
--- a/postfix-logwatch
+++ b/postfix-logwatch
@@ -2815,6 +2815,28 @@ sys     0m3.005s
 
    $rej_type = undef;
 
+   if ($p1 =~ /^NOQUEUE: (timeout|lost connection|too many errors)/) {
+       # In postfix 3.10.0, these lines gained a NOQUEUE prefix. For
+       # backwards-compatibility, we strip the NOQUEUE ahead of time,
+       # so that the case that used to match them will still match
+       # them. Otherwise, the "NOQUEUE" is matched by $re_QID, and we
+       # end up in a different branch entirely. We could cut & paste
+       # the case that matches them of course, but it's nicer if we
+       # can support both old and new formats at the same time.
+       #
+       # Examples:
+       #
+       # NOQUEUE: lost connection after STARTTLS from localhost[127.0.0.1]
+       # NOQUEUE: timeout after END-OF-MESSAGE from localhost[127.0.0.1]
+       # NOQUEUE: too many errors after RSET from localhost[127.0.0.1]
+       #
+       # Ref:
+       #
+       # https://www.postfix.org/announcements/postfix-3.10.0.html
+       #
+       $p1 =~ s/NOQUEUE: //;
+   }
+
    # ^$re_QID: ...
    if ($p1 =~ s/^($re_QID): //o) {
       $qid = $1;