[ossec-dev] Postfix rules

[Trey Valenta <t@xxxxxxxx>]

I'm running ossec with postfix_rules.xml,v 1.15
2007/07/19 23:49:56 dcid Exp $. Rule 3331 (insufficient system storage)
triggers when the destination relay reports a deferred error. I'd like
modify this rule and alert only if my server is out of space. Can anyone
suggest how to make this change? Does anyone have a sample error message
from a managed mail server with insufficient space?

Thanks,
Trey Valenta


Received From: smtp1.foo.com->/var/log/mail.info
Rule: 3331 fired (level 10) -> "Postfix disk space error."
Portion of the log(s):

Sep 14 00:47:41 smtp1.foo.com postfix/smtp[83540]: 885B927AS2:
to=<user@xxxxxxxx>, relay=smtp.foo.jp[123.123.123.123],
delay=10674, status=deferred (host smtp.foo.jp[123.123.123.123]
said: 452 insufficient system storage)



-- 
<t(Trey)@(Valenta)trey.net> Seattle, Wash.
Are you pondering what I'm pondering?
Well, I think so Brain, but what if we stick to the seat covers?