Open a saved log
Open a plain-text log such as maillog, or drag it into the app. Set a log start date and time to display and aggregate events from that point onward.
LOGGRAPHIC / POSTFIX MAIL OBSERVATORY
Understand Postfix logs. Visualize every mail flow.
Visualize historical Postfix logs saved on your PC, analyze delivery outcomes and replay past mail activity. Follow current server activity through SSH LIVE monitoring, too.
Kali Linux · amd64PostfixSSH LIVE日本語 / English / 한국어 / 简体中文 / 繁體中文
Last updated:
NEW · 2026-11-04 · 1.20.0-20261104002227
Find a logged sender and ban its source IP with Fail2ban.
LogGraphic 1.20.0 adds a form that accepts a sender email address, finds source IPs in retained logs and lets you register a selected IP with Fail2ban.
Find sources by email address
Open Actions → Ban by email address…, enter one sender address and choose Search source IPs. The same button is available in ADDRESS FLOW; a selected sender node prefills its address.
Review the evidence and ban one IP
Candidates are grouped by source IP and logged server. Review host names, queue/rejection record counts, event counts, first/last timestamps (UTC) and the latest supporting log. Select one IP to open the existing Fail2ban confirmation window.
Search covers all retained analysis logs independently of the main search, event filter and playback position. A zero retention limit disables lookup. Editing the input clears previous results, and the current logs are checked again before proceeding with an action.
The resource lookup now finds the bundled files used to list and run Python extensions when the Linux package is installed under the standard /usr prefix.
Read changes and upgrade instructions →POSTFIX LOG ESSENTIALS
Where Postfix logs are stored and how to read them
Postfix logs record connections, queue processing and delivery attempts. To investigate missing mail, correlate the timestamp, server and Queue ID across related entries instead of deciding the cause from one error line.
Locate the actual log destination
Linux installations may use /var/log/maillog, /var/log/mail.log or another destination. Check maillog_file, syslog routing and the journal if the expected file is absent.
postconf maillog_file
sudo tail -n 100 /var/log/maillogReplace the example path with your configured destination and use an account authorized to read it. Find logs and troubleshoot missing output.
Follow a Queue ID
smtpd receives SMTP, cleanup prepares messages, qmgr manages the queue and smtp delivers over SMTP. Keep records from different servers and time periods separate.
sudo grep -F '4F2A812345:' /var/log/maillogThis example uses a fictional ID. from and to identify envelope addresses; relay identifies the next delivery hop. Envelope addresses can differ from message headers.
Read an annotated log example. Official references: Postfix logging and debugging and architecture overview.
Interpret delivery results and investigate missing mail
Read status, dsn and the SMTP response together. Results are recorded per recipient and attempt: counting lines does not necessarily count unique messages. Use the same time window and counting unit when comparing delivery rates.
| Record | Meaning and next check |
|---|---|
sent | The delivery operation succeeded. SMTP relay acceptance does not prove final inbox placement or reading. Check downstream logs, filtering and forwarding if mail is missing. |
deferred | Temporarily delayed. Read the reason: timeout, DNS, network or temporary rejection. A later attempt may succeed. |
bounced | Permanent failure for this recipient. Check the address and rejection reason; other recipients can have different outcomes. |
NOQUEUE: reject | Rejected before queueing. Correlate time, client IP, process ID and SMTP response when there is no Queue ID. |
delay and delays help locate time spent during delivery, but a large value alone does not establish the cause. Investigate delays and authentication failures.
postqueue -p lists mail currently queued. Historical event counts are different from current queue counts. Queue inspection and message content · Official postqueue manual.
FOLLOW THE MESSAGE
From sender to destination
Use address flows to inspect who sends to whom, and server flows to inspect the next delivery hop.
Sendersender@example.org
POSTFIXReceive · Queue · Deliver
Destination servermx.example.net
Illustrative animation, not live server data. In the app, log playback speed and particle animation speed are independent.
HISTORICAL LOG ANALYSIS
Visualize historical mail logs, whenever you need them
Load previously downloaded or backed-up Postfix logs in the LogGraphic desktop app. Investigate past delivery issues and review earlier mail activity from saved log files.
Analyze outcomes and destinations
Explore successful, failed and deferred deliveries, traffic over time, sender and recipient addresses, and destination servers in charts and flows. Search by address, IP or queue ID.
Replay the log timeline
Replay past mail activity with animation. Pause, fast-forward or seek to a time of interest, then hover over charts and flows for details.
EXPLORE YOUR MAIL LOGS
Tools for mail investigation
Delivery activity in one view
Review successful, failed, deferred and rejected deliveries. Traffic timelines and peer charts help you inspect changes over time and delivery outcomes.
Address and server flows
ADDRESS FLOW connects sender and recipient email addresses. MAIL FLOW shows Postfix and actual destination servers. Hover for details.
Historical logs and SSH LIVE monitoring
Load downloaded Postfix logs and narrow results by start time and search. Configure an SSH connection to continuously monitor logs on your server.
Country statistics and a world map
Explore country access shares and delivery volumes. Lines and particles show traffic direction on the world map. Country labels include registration and domain-based estimates.
Queues, domains and DKIM
Inspect mail queue entries, destination analysis for registered domains and recorded DKIM processing. Queue actions and Fail2ban integration depend on server permissions and configuration.
A dashboard that fits your workflow
Show or hide panels, drag them to new positions, resize them and save your layout. Switch the app interface between Japanese, English, Korean and Simplified Chinese.
Two flows, two perspectives
| Panel | What it shows |
|---|---|
| ADDRESS FLOW | Sender → recipient email addresses. The compact dashboard panel displays the records that fit its viewport. Use the mouse wheel to explore retained history, or click to open the detailed window. |
| MAIL FLOW | Incoming connections → Postfix → the next destination server recorded in the relay field. |
In 1.16.4, choose Edit → Show and go to ADDRESS FLOW to reveal the compact panel.
Install and update on Kali Linux
Latest release: 1.20.0-20261104002227
LogGraphic 1.20.0 adds a form that accepts a sender email address, finds source IPs in retained logs and lets you register a selected IP with Fail2ban.
Website update: historical log visualization
— Read about loading saved logs, reviewing delivery outcomes and replaying the timeline. Includes new Q&A and Japanese / English guidance.
1. Add the repository
Run these commands in your Kali terminal. The setup script backs up any existing LogGraphic repository configuration before updating it.
curl -fSLo setup-loggraphic-apt.sh \
https://repo.sb-i.jp/loggraphic/setup-loggraphic-apt.sh
sudo bash setup-loggraphic-apt.sh2. Install
sudo apt install loggraphicAfter installation, launch LogGraphic from your desktop application menu.
Upgrade an existing installation
sudo apt update
sudo apt install --only-upgrade loggraphicapt update refreshes package information. Run the second command to upgrade the app itself. You can also use the installed loggraphic-update command.
Repository information
Package list · Signed metadata · Public key
Signing key fingerprint
63568A9E12857E8E12B434028FAA7CE5A840DE0DPackages in this repository are for Kali amd64.
Frequently asked questions
Can I visualize historical log files?
Yes. Open saved Postfix plain-text logs in the LogGraphic desktop app to analyze delivery outcomes, view address and server flows, and replay events along the timeline. File analysis does not require an SSH connection to the server.
Does apt update upgrade the application?
No. It refreshes the package index. Then run sudo apt install --only-upgrade loggraphic and restart the app.
Can I launch the GUI over a normal SSH connection?
A GUI needs a display. Start it in the Kali desktop session or use a configured display-forwarding environment.
Does a country label identify the exact server location?
No. Country labels may come from registration information or country-code domains. They do not guarantee the physical location of an IP address.