Sendmail Data In Graylog

Email is still one of the most heavily abused paths into an organization, and the server that routes it sits on a mountain of security-relevant data that most teams never look at. Sendmail is a free and open source mail transfer agent (MTA) that has been routing and delivering mail on Unix-based systems for decades.  Its logs quietly record every connection, authentication attempt, delivery outcome, and rejection that passes through it.

The Sendmail Mail Server Content Pack for Graylog parses that log data into Graylog schema-compatible fields. It gets mapped to the Graylog Information Model (GIM), and ships with a six-tab Illuminate spotlight dashboard so your team gets structured visibility instead of a scrolling wall of raw text. This pack is available with a Graylog Illuminate license and Graylog Enterprise or Graylog Security.

What Is Sendmail?

Sendmail is one of the oldest and most widely deployed mail transfer agents in existence. Despite newer alternatives like Postfix and Exim gaining ground, Sendmail remains common in legacy Unix and Linux environments, appliances, and long-running production systems. Very common where migrating the mail stack is not a trivial undertaking.

Because Sendmail sits directly in the path of every inbound and outbound email transaction, its logs capture the full lifecycle of a message:

• Who connected?
• Were they authenticated?
• Was TLS negotiated?
• Where was the message was routed?
• Was it was accepted or rejected, and why?

That makes Sendmail logging a rich and often underused source of security telemetry, not just a mail delivery troubleshooting tool.

What This Pack Does

The content pack takes raw Sendmail log lines, most of which look like unstructured key-value fragments, and turns them into normalized, searchable, correlatable fields. It includes:

Getting Sendmail Logs Into Graylog

Sendmail logs can reach Graylog through either syslog or Filebeat, depending on how your environment already ships logs.

Option 1: Syslog

1. Create a matching syslog input in Graylog (UDP or TCP).
2. Configure your syslog server, for example rsyslog, to forward mail facility logs to that Graylog input.
3. Confirm the forwarded logs are RFC 5424 compliant. Only RFC 5424 compliant syslog messages are accepted through this method.

Option 2: Filebeat

1. Create a matching Beats input in Graylog.
2. Create an API access token and a Linux Filebeat collector.
3. Configure the collector to read Sendmail log files, for example /var/log/maillog.
4. Set event_source_product to ‘sendmail’ in the Filebeat fields configuration so events route and parse correctly.

Events Processed

The pack recognizes and parses the full range of events a Sendmail deployment generates in daily operation, including:

• Receipt and delivery events, including sender, recipient, message size, message ID, and delivery status
• Authentication events (AUTH=server), including SASL mechanism and encryption bit strength
• STARTTLS negotiation events, including TLS version, cipher, and certificate verification status
• Inbound connection events, including relay IP and hostname, with forged-hostname warnings where applicable
• Ruleset rejection events, including the ruleset name and SMTP rejection reason
• Pre-greeting and discovery rejection events, indicative of automated scanning or non-compliant clients
• Milter(Mail Filter) content filter rejections, including spam and malware filter actions
• Lost connection and timeout events
• Daemon start, stop, and system error (SYSERR) events

Example log lines processed by this pack include:

• An SMTP receipt entry showing sender, recipient count, and relay origin
• An AUTH entry recording the SASL mechanism used
• A STARTTLS entry showing a client that did not present a verifiable certificate
• A Milter entry rejecting a message as “Blocked by SpamAssassin”

Each of these is parsed into individual fields, such as:

• source_ip
• vendor_auth
• vendor_tls_version
• vendor_reject

…rather than left as a single unstructured text blob

GIM Categorization

Every parsed event is mapped to the Graylog Information Model, giving each Sendmail log type a consistent event category, subcategory, and event type so it can be correlated alongside data from firewalls, endpoints, identity providers, and every other GIM-mapped source in your environment.

Why Log Sendmail Events?

Mail server logs are easy to overlook because they feel like plumbing rather than security telemetry. In practice, Sendmail logs surface some of the earliest signals of credential abuse, spam and phishing infrastructure abuse, and misconfigured relays that attackers actively look for.

Security Monitoring

Authentication events (AUTH=server) and STARTTLS negotiations reveal who is authenticating to your mail server, which mechanism they used, and whether encryption was actually established. A spike in failed or unusual authentication mechanisms, or repeated TLS sessions with verify=NO, are both signs worth alerting on rather than ignoring.

Threat Hunting

Fields like source_ip, source_hostname, and vendor_relay_warning (which flags relay hostnames that “may be forged”) let analysts hunt for spoofed reverse DNS and scanning activity aimed at your mail infrastructure. Milter rejection reasons and ruleset rejections also help hunters spot spam and malware campaigns being tested against your filters before one gets through.

Incident Response

Every Sendmail transaction carries a queue ID (email_uid) that ties its receipt, delivery, rejection, and error events together. During a phishing or business email compromise investigation, that queue ID lets responders reconstruct the full path of a specific message, including which host relayed it and how it was ultimately handled, without piecing together raw log fragments by hand.

Compliance

The pack’s default 90-day retention, combined with structured visibility into authentication and encryption-in-transit (STARTTLS) activity, supports audit requirements under frameworks like SOC 2, PCI DSS, and CIS Controls that call for demonstrable oversight of how email transport is secured and monitored.

Ready to get started? Graylog Security and Graylog Enterprise with Illuminate give you this content pack plus coverage for dozens of other critical log sources out of the box, with no manual parsing required.