spamassassin statistics, passing information between scripts
Orion Poplawski <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
I'm attaching a patch I'm using to collect some spam statistics, namely:
Top 10 Spam Relays:
[213.108.48.225]: 11 Time(s)
[213.108.51.35]: 10 Time(s)
[173.213.69.169]: 8 Time(s)
[78.138.105.16]: 7 Time(s)
[213.108.52.48]: 7 Time(s)
[38.114.102.49]: 6 Time(s)
cluster158.reversestart.com [198.24.129.158] (may be forged): 6 Time(s)
host.colocrossing.com [206.217.133.94] (may be forged): 6 Time(s)
portal.shelterrockmission.com [96.127.172.142]: 6 Time(s)
[173.213.69.137]: 6 Time(s)
At our site we're running spamass-milter and rejecting messages with a score
of 10 or higher, but marking 5+ as spam. So I was curious as to what was
making it through (so I guess this is really "Top 10 Accepted Spam Relays").
In order to do this, I needed to also process sendmail messages in the
spamassassin service to be able to match up message ids. I'm not particularly
happy with this.
I wonder if some kind of generic method for allowing a service script to save
information that other scripts could then retrieve would be useful? Thoughts?
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder Office FAX: 303-415-9702
3380 Mitchell Lane [email protected]
Boulder, CO 80301 http://www.nwra.com
------------------------------------------------------------------------------
Keep yourself connected to Go Parallel:
TUNE You got it built. Now make it sing. Tune shows you how.
http://goparallel.sourceforge.net
_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
logwatch-spamassassin.patch
(text/x-patch, 2.9 KB)
Index: conf/services/spamassassin.conf
===================================================================
--- conf/services/spamassassin.conf (revision 117)
+++ conf/services/spamassassin.conf (working copy)
@@ -5,7 +5,8 @@
Title = "SpamAssassin"
LogFile = spamassassin
-*OnlyService = spamd
+# Pull in sendmail for matching msgid to sender for statistics
+*OnlyService = (spamd|sendmail)
*RemoveHeaders
# Ignore connections from these hosts.
Index: scripts/services/spamassassin
===================================================================
--- scripts/services/spamassassin (revision 117)
+++ scripts/services/spamassassin (working copy)
@@ -69,7 +69,7 @@
( $ThisLine =~ m/connection from localhost / ) or
( $ThisLine =~ m/setuid to / ) or
( $ThisLine =~ m/processing message / ) or
- ( $ThisLine =~ m/^spamd: result: / ) or
+ ( $ThisLine =~ m/^spamd: result: .*,mid=\(unknown\)/ ) or
( $ThisLine =~ m/^prefork: child states: / ) or
( $ThisLine =~ m/^spamd: alarm *$/ ) or
( $ThisLine =~ m/^spamd: handled cleanup of child / ) or
@@ -77,6 +77,9 @@
( $ThisLine =~ m/^logger: removing stderr method/ ) or
( $ThisLine =~ m/^spamd: server pid:/ ) or
( $ThisLine =~ m/^prefork: adjust: \d+ idle children (less|more) than \d+ (min|max)imum idle children/ ) or
+ # Sendmail messages to ignore
+ ( $ThisLine =~ m/^AUTH=/ ) or
+ ( $ThisLine =~ m/^STARTTLS/ ) or
0 # Always last in the list, so all above can say "or" at the end
) {
; # We don't care about these
@@ -99,6 +102,18 @@
# ... at /usr/bin/spamd line 1085, <GEN5490> line 212
$ThisLine =~ s/\d+/___/g; # Make all numbers "generic"
$Child{ $ThisLine }++; # ...and count generic error types
+ } elsif ( ($spam, $score, $msgid) = ($ThisLine =~ m/^spamd: result: (.) (-?\d+).*,mid=<(.*)>/) ) {
+ # Only record the first scan
+ if (!defined($msg{$msgid}->{"score"}) and $spam eq "Y" and $score < 10) {
+ $msg{$msgid}->{"score"} = $score;
+ $SpamRelay{$msg{$msgid}->{"relay"}}++;
+ }
+ } elsif ( $ThisLine =~ m/^q\w+:/ ) {
+ # Sendmail lines for statistics
+ if ( ($from, $msgid, $relay) = ($ThisLine =~ m/^q\w+: from=<(.*)>, .*, msgid=<(.*)>, .*, relay=(.*)/) ) {
+ $msg{$msgid}->{"from"} = $from;
+ $msg{$msgid}->{"relay"} = $relay;
+ }
# EVERYTHING ELSE, or, Incentive to identify all "We don't care" lines
# We on-purpose allow warnings about --max-children to go here
@@ -137,6 +152,15 @@
int ((100.0 * $SpamTotal / $ttotal) + 0.5);
}
+if (keys %SpamRelay) {
+ print "\nTop 10 Spam Relays:\n";
+ $i = 0;
+ foreach $relay (sort {$SpamRelay{$b}<=>$SpamRelay{$a} } keys %SpamRelay) {
+ print " $relay: $SpamRelay{$relay} Time(s)\n";
+ last if ++$i == 10;
+ }
+}
+
if ( $StillRoot ) {
print qq{\n"still running as root" error: $StillRoot time(s)\n};
}