Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.20

http-log-tls

Globalrestart required

Whether to log the course of the TLS handshake on the web monitor
in the configuration this is a linehttp-log-tls falseinside the block Global
Handshake details in the monitor log

With true, the monitor logs how encryption negotiation with the client went: the version, the cipher, what each side offered. Off by default.

The monitor has its own log — /var/log/pmta/pmtahttp.log, separate from the engine log. Denials under http-access go there too, and the manual advises looking for the address of an unlucky client exactly there.

The line is needed only for the duration of an investigation. Permanently it gives nothing: successful handshakes are monotonous, and the logging volume on a busy interface is noticeable.

The main trap is enabling it and forgetting. The investigation is over, but logging goes on: the monitor log grows with every poll, and the little it is read for — access denials — drowns in it.
What the Hub does. It does not write it: polling goes over a plain connection, and there is nothing to log. The line will come in handy if the management interface is moved to encryption and the handshake stops succeeding.
Recommended values

Enabled for the investigation and disabled after:

Value When
false (default) normal operation
true investigating why the client does not negotiate encryption
The default false and the purpose are from the manual (§ 3.3.1.58.20). The name of the monitor log is from § 3.3.1.58.3, its directory is set by the log-file line (§ 3.3.1.59.2). The advice to disable it after the investigation is ours.
Example configuration
# for the investigation: the client does not negotiate encryption
http-mgmt-port 1000
http-log-tls true
After the investigation the line is removed. Permanent handshake logging clutters the log in which access denials are looked for.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Looking for handshake records in the engine log

our experience

What it costsThe monitor has a separate log. These lines will never appear in /var/log/pmta/log, however much you enable.
How to spot itThe line is enabled, but nothing has changed in the usual log.
How to do it rightLook at /var/log/pmta/pmtahttp.log.

Leaving logging on after the investigation

our experience

What it costsEvery monitor poll adds lines. The log grows, and access denials have to be searched for in it.
How to spot itThe monitor log grows faster than the engine log.
How to do it rightSet false back and restart the monitor.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-log-tls <boolean>
Values
yes | no | true | false
Default
false § 3.3.1.58.20
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive has no inheritance: it is written at the root of the file, the Global section, and applies to the node’s whole management interface.
⇄

Related directives

2 relations

Works together with

http-log-requestsGlobalBoth write to the monitor’s own log: this one about the handshake, that one about the requests. inference

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.20

How to check on the node
We check by the log itself — open it and make one connection to the monitor:
tail -f /var/log/pmta/pmtahttp.log
With logging on, lines about the version and cipher will appear in the log. Empty — either the line has not taken effect (the monitor needs a restart), or the client connected without encryption.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:log-filelog-rotatelog-auto-rotationdummy-smtp-await-slotdummy-smtp-portAll 108 directives of the block →