Out of the box, every FreeBSD machine sends two e-mails per day to the administrator (root -- usually aliased to someone):

  • Daily cron output (with status of disks, network interfaces, etc.)
  • Daily security output (with penetration-attempts found in logs, etc.)

There are also weekly and monthly report-pairs, with outputs of the jobs deemed "heavier" (like locate-updates), which do not require daily runs.

Most of the time these e-mails are tedious to the extreme and I often find myself deleting them without reading. But I feel guilty doing it -- because one day I'm liable to miss something important and because, if I'm not reading it, I may as well redirect them into /dev/унітаз to begin with.

With 5-7 FreeBSD boxes (of my own and immediate family) under my care, this is getting bothersome -- is there, perhaps, some sort of software, that can alert me to potentially "interesting" reports while quietly stashing the rest away? Something "trainable" -- like a Bayesian spam-filter?

Ideally, it would integrate with Seamonkey/Thunderbird, but can also be command-line based (I'll run it from inside ~/.procmailrc)...

  • 1
    If you're wanting to be able to go in and analyze logs of multiple servers, something like Splunk would probably work nicely; otherwise you could modify the cron jobs to only email if certain thresholds are exceeded in the reports that are now being blindly emailed.
    – DopeGhoti
    Jul 5, 2017 at 15:37
  • I used Splunk - it is not trainable. You can only express rules syntactically, not semantically... :(
    – Mikhail T.
    Jul 14, 2017 at 15:22

1 Answer 1


Regular expressions in procmail can span multiple lines (but, as with everything in procmail, you need to be careful lest a typo cause your rule to fail silently). In the past, I've written procmail recipes that match a report when everything goes well, and saves them to the noise mailbox. Then, if that report lands in my mailbox, it means that there's a problem I need to look at (either that, or that I have a problem with my .procmailrc)

Here's an example that looks at both the header and body of the message, and examines a complex report I used to receive at an old orkplace:

:0 :
* ^From: [email protected]
* ^To: [email protected]
* ^Subject: cron output from host.my.dom.ain
* B ?? ^^No account processing to do this run\.\.\.\
^Configuring databases\.  Please wait\.\.\.\
(^\*\*\* No IP address for.*)*\
^Processed [0-9]+ total hosts with the following distribution:\
(^[0-9]+        (common|osX|win(7|8)))+
^Generated [0-9]+ ganglia clusters containing [0-9]+ machines\
(^Installing new ssh_known_hosts\.\.\.)?\
^Looking for sendmail aliases to generate\
(^No users in passwd file that have no \(valid\) entry in aliases\.forward)?\
^Updating the serial number in .*\.Zone )*\
(^Updating hosts file)?)+

When you're writing your recipe, I recommend that you use a test message file and a test procmail file. Have the recipe save the message to a test file, then run procmail manually. Check the logging output to make sure that all of the conditions match. For the body-match part, try writing that one line at a time.

  • That's still "syntactic" rules. I'm looking for a semantic system -- something trainable, that will automatically learn, what is normal and mundane, and what stands out...
    – Mikhail T.
    Aug 7, 2017 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .