[syslog-ng] [PATCH] afsmtp: New destination driver, to send mails via SMTP.

[Patrick Hemmer]

Sent: Fri Feb 03 2012 09:03:05 GMT-0500 (EST)
From: Gergely Nagy <algernon at balabit.hu>
To: syslog-ng at lists.balabit.hu
Subject: [syslog-ng] [PATCH] afsmtp: New destination driver, to send 
mails via SMTP.
> This introduces the afsmtp destination driver, updated to the latest
> 3.4 conventions, and with all the threading bugs that were also
> present in afmongodb too, fixed.
>
> The driver itself uses libESMTP to send mail, and has the following
> config syntax:
>
> destination d_smtp {
>   smtp(
>    host("localhost") port(25)
>    subject("ALERT! IMPORTANT EVENT FROM ${HOST}")
>    header("X-Severity", "${SEVERITY}")
>    from("no-reply@${HOST}.dummy")
>    to("syslog-alerts at my.example.domain")
>    bcc("big-brother at my.example.domain")
>    cc("it at my.example.domain")
>    reply-to("admin at my.example.domain")
>   );
> };
>
> Signed-off-by: Gergely Nagy<algernon at balabit.hu>

This looks like it'll be fairly useful, but I do have one suggestion, 
support the `dest_writer_option` parameters. Specifically flush 
lines/timeout and template.
I can imagine using this to send an email notification on critical 
alerts, and often you'll get a batch of several messages marked as 
critical. So instead of having a separate email for every message, a 
flush_timeout could be used to only send the email once we've waited a 
second or so for them all to come in.
Template would also be useful, but not as important as the flush 
parameters I think. The template should be able to control the contents 
of the email body. Couple arguments for this. First is that emails are 
generally multi-line, so being able to have a template like "Host: 
$HOST\nProgram: $PROGRAM\nMessage: $MSGONLY\n\n" would make for nice 
easy reading. Second is that this might be used to send to pagers or 
mobile phones where message length is limited, so being able to set the 
template and get only the necessary information is important.

Thanks, this will be a nice feature :-)

-Patrick