In Postfix, how can I find the recipient address using Message-ID?
Grepping logs with Message-ID will give you a Postfix Queue ID:
# grep XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX mail.log
Oct 3 00:10:48 mx postfix/cleanup[25302]: YYYYYYYYYY: message-id=<XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX>
YYYYYYYYYY
is the Queue ID here. Now you have to grep again:
# grep YYYYYYYYYY mail.log
Oct 3 00:10:48 mx postfix/smtpd[25294]: YYYYYYYYYY: client=????????????????????
Oct 3 00:10:48 mx postfix/cleanup[25302]: YYYYYYYYYY: message-id=<XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX>
Oct 3 00:10:48 mx postfix/qmgr[30545]: YYYYYYYYYY: from=<[email protected], ...
Oct 3 00:10:48 mx postfix/lmtp[25306]: YYYYYYYYYY: to=<[email protected]>, ...
Oct 3 00:10:48 mx postfix/qmgr[30545]: YYYYYYYYYY: removed
As you see, grepping with either one doesn't differ much. Notice, external actors likely to tell you Message ID, because they may be unaware of your internal Queue ID.
In my case lmtp
logged the recipient address because this was locally delivered mail with LMTP, but in case of ougoing mail the service that should log the "to" address could be smtp
.
In any case, -C
may not help, because there could be lines that intervene with this mail processing. Also, notice, normally log files get rotated, so you may need to look up in older files, mail.log.1
and so on. Old files might be compressed, so use for example zgrep YYYYYYYYYY mail.log.2.gz
, or whatever on your system it is.