There's bug in ispcp-vrl-traff that causes (many) mails to be unaccounted when /etc/hosts does not contain the server name as the first entry for the loop back interface as in:
127.0.0.1 localhost localhost.localdomain
In this case the log output from maillogconvert.pl contains "localhost" as the $5 and $6 parameters (this is correct) even for local deliveries.
However, the following awk script in ispcp-vrl-traff, line 343 ignores these entries:
$cmd = "$cat $smtp_delivery_log | $awk '{if (\$5 != \"localhost\" && \$6 != \"virtual\" && \$6 != \"localhost\" && \$10 != \"?\") print substr(\$3, index(\$3, \"@\")+1, length(\$3)),substr(\$4, index(\$4, \"@\")+1, length(\$4)),\$10;}' 1>$smtp_log";
Hence the problem occurs.
The solutions:
1. Make a better script.
<or>
2. Make sure that the first entry in /etc/hosts is something different than "localhost".
ispcomm.
