Quick question about logging

[Mark Martinec]

Jim,

> Running 2.6.4 with Zimbra.
> I've noticed sometimes there are two sets of IP addresses logged:
> 
> Mar 10 17:22:55 mymail amavis[25723]: (25723-14) Passed SPAMMY,
> [98.139.44.147] [41.138.89.39] ...
> 
> Can someone tell me where these are pulled from?
> (Which part of the message header.)

This is coming from a default log template, it inserts macros %a and %e,
if nonempty. According to README.customize:

  a  original SMTP session client IP address (info from XFORWARD)
  e  best guess of the originator IP address collected from the Received trace


Mark