minor nomatch errors about postfix-grok-patterns HOT 2 CLOSED

There are no 'nomatch' errors, it's just a helper to find lines that I might have missed. When their content is not interesting, there is no need to grok them.

The first example is indeed not supported, but should be. The warning looks like a c/p error though, the message is repeated twice.

The second example is harder. Does the line contain any useful data to you? I.e. anything that you feel should be grokked out of it? if so, could you give an example of the data you would like to extract?

Furthermore: when I do a header replace on my system, this is applied by the cleanup daemon, not by the smtp daemon as in your example. Could you give me an unaltered example line?

from postfix-grok-patterns.

No, I don't need the data, thought it would be interesting for completeness. The repeating message was no c/p error, I added a field via grok to the message field, which did already exist. My mistake. So the line would be

Nov 23 20:15:38 elk postfix/smtp[XXXX]: QID: replace: header From: "(Cron Daemon)" <XXX>: From: XXX

But I verified that the message is indeed from the smtp program, if you're interested, the corresponding lines in /etc/postfix/main.cf are

sender_canonical_classes = envelope_sender, header_sender
sender_canonical_maps = regexp:/etc/postfix/sender_canonical_maps
smtp_header_checks = regexp:/etc/postfix/header_check

Postfix version is 2.10.1 and my OS is CentOS 7.4.

from postfix-grok-patterns.