Logging question

[Henrik K]

On Thu, Mar 29, 2012 at 09:25:50AM +0200, Ralf Hildebrandt wrote:
> Mar 29 09:13:20 mail2 amavis[16916]: (16916-16) Passed CLEAN {RelayedOutbound}, LOCAL [141.42.206.36]:37952 [85.179.68.181]
> <absender at charite.de> -> <empfaenger at gmail.com>, Message-ID: <86e7921583186ccc7b08fa356655af14.squirrel at webmail.charite.de>,
> mail_id: hK-6Jq4eATvE, Hits: -2.14, size: 3977, queued_as: 3VJHHN5wKjz1tJd, dkim_new=default:charite.de, 538 ms
> 
> [141.42.206.36]:37952 is my mailserver, but what is 85.179.68.181?
> 
> Under which circumstance does amavis log 2 IPs in [] and what info is
> being logged there?

Well it's all there if you look for it..

# This text section governs how a main per-message amavisd-new log entry (at
# log level 0) is formed (config variable $log_short_templ). Empty disables it.
[?%#D|#|Passed #
[? [:ccat|major] |#
OTHER|CLEAN|MTA-BLOCKED|OVERSIZED|BAD-HEADER-[:ccat|minor]|SPAMMY|SPAM|\
UNCHECKED|BANNED (%F)|INFECTED (%V)] {[:actions_performed]}#
, [? %p ||%p ][?%a||[?%l||LOCAL ][:client_addr_port] ][?%e||\[%e\] ]%s -> [%D|,]#
...

http://www.ijs.si/software/amavisd/README.customize.txt
  e  best guess of the originator IP address collected from the Received trace