Mail Server Log Parser

Postfix and Sendmail logs read like a telegraph: postfix/smtp[1301]: D6E1A2: to=, relay=mx.net[203.0.113.5]:25, delay=0.5, status=sent. Mail Server Log Parser turns that telegram into per-event facts — queue id, sender, recipient, relay, delay and delivery status — with the envelope attributes extracted where present.

Status buckets and simple rankings (recipients, senders, relays, connecting clients) answer “what went out, did it land, and to where.” while soft failures and bounces keep their own counts.

• Postfix + Sendmail — maillog lines decoded.
• Envelope extraction — from, to, relay, delay.
• Status buckets — sent / deferred / bounced / failed.
• Volume leaders — recipients, senders, relays, clients.
• Copyable report.
• Local only — nothing uploaded.

1. Paste maillog lines — Postfix (syslog-style, with or without the leading host) or Sendmail stat= lines. Lines can be mixed together; each is matched independently.
2. Toggle Detail rows if you want the full field breakdown per line (status, to, from, relay, delay, client) instead of a compact one-line-per-message summary.
3. Click Parse. Every recognized line becomes an event; the queue id at the start of the message body (if present) is stripped and stored separately so it does not pollute the extracted fields.
4. Read the delivery buckets first — sent, deferred, bounced — then check the top recipients, senders, relays and clients sections for who or what is driving the volume.
5. Copy the report for a mail review or an incident ticket.

Example 1 — Bounce hunt. A spike in the bounced bucket with one dominant recipient in the top-recipients list points at a bad forwarding address or a full mailbox rather than a systemic delivery problem.

Example 2 — Relay reputation. The relay ranking shows which provider handles the bulk of outbound traffic; if deferrals concentrate on one MX in that list, that specific destination — not your whole mail queue — is greylisting or rate-limiting you.

Example 3 — Outbound audit. Sender volume exposes an account that started sending an unusually large number of messages, which is often the first visible sign of a compromised mailbox being used to send spam.

Example 4 — Multi-line delivery trace. Because each queue id ties related lines together conceptually (connect, from=, to=, status=), pasting the full sequence for one message — accept, queue, and final relay attempt — lets you follow a single email from arrival to its delivery outcome.

• Daemon aware — per-service and per-PID detail.
• Status clear — delivered vs deferred vs bounced.
• Envelope rich — to, from, relay captured.
• Volume radar — quick leaderboards.
• Private — all processing client-side.