search

sergeymakinen / postfix_exporter

Export Postfix stats to Prometheus
BSD 3-Clause "New" or "Revised" License
11 stars 0 forks source link

Error parsing log record #8

Closed rezfarsh closed 10 months ago

rezfarsh commented 10 months ago

Hey,

We are trying to you use this exporter on RHEL 8.7 with postfix version 3.5.8. Our log lines look like this:

2023-11-30T22:09:43.255136+00:00 HOSTNAME IP_ADDRESS/smtpd[273137]: disconnect from abc.xyz.com[xxx.xxx.xxx.xxx] ehlo=1 mail=12 rcpt=12 data=12 rset=11 commands=48 2023-11-30T22:09:43.256146+00:00 HOSTNAME IP_ADDRESS/smtpd[275221]: disconnect from abc.xyz.com[xxx.xxx.xxx.xxx] ehlo=1 mail=20 rcpt=20 data=20 rset=19 commands=80 2023-11-30T22:09:43.268411+00:00 HOSTNAME IP_ADDRESS/smtpd[274085]: disconnect from abc.xyz.com[xxx.xxx.xxx.xxx] ehlo=1 mail=19 rcpt=19 data=19 rset=18 commands=76

We are getting the following error when running the exporter:

ts=2023-11-30T21:27:08.821Z caller=exporter.go:145 level=debug msg="Error parsing log record" err="parsing time \"2023-11-30T21:27:08.657173+00:00 HOSTNAME IP_ADDRESS/smtpd[262090]:\" as \"Jan 2 15:04:05\": cannot parse \"2023-11-30T21:27:08.657173+00:00 HOSTNAME IP_ADDRESS/smtpd[262090]:\" as \"Jan\"" ts=2023-11-30T21:27:08.821Z caller=exporter.go:145 level=debug msg="Error parsing log record" err="parsing time \"2023-11-30T21:27:08.662588+00:00 HOSTNAME postfix/cleanup[265195]:\" as \"Jan 2 15:04:05\": cannot parse \"2023-11-30T21:27:08.662588+00:00 HOSTNAME postfix/cleanup[265195]:\" as \"Jan\"" ts=2023-11-30T21:27:08.821Z caller=exporter.go:145 level=debug msg="Error parsing log record" err="parsing time \"2023-11-30T21:27:08.667535+00:00 HOSTNAME IP_ADDRESS/smtpd[262090]:\" as \"Jan 2 15:04:05\": cannot parse \"2023-11-30T21:27:08.667535+00:00 HOSTNAME IP_ADDRESS/smtpd[262090]:\" as \"Jan\""

It seems the exporter is not able to parse the timestamps correctly. We have tried this with both file collector and journald options. Any suggestions how to fix this?

Thanks in advance!

sergeymakinen commented 10 months ago

Thanks @rezfarsh. It's interesting to see a different timestamp format, I'll need some time to learn more why and how this happens and then I'll should be able to come back with a solution.