https://bugs.contribs.org/show_bug.cgi?id=8818
Jean-Philippe Pialasse <[email protected]> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
--- Comment #4 from Jean-Philippe Pialasse <[email protected]> ---
ok, the acounting is said to be for "net mail in" et "net mail out"
I think then it is not sqpsmtpd and qpsmtpd that should be accounted for.
We get from there all connexions from outside the server to send email to the
server or remotly. We miss internally sent email (deamons and php at least)
Furthermore, lot of connexion will be refused. the current logging is for brut
incoming connexion for mail, and account both for their RCPT and recipient.
#@4000000043a825c60ff26f84 6556 dispatching RCPT
TO:<[email protected]>
#@4000000043a825c60ff26f84 6556 dispatching RCPT
TO:<[email protected]>
if ($l =~ /@[0-9a-f]{24} \d+ dispatching RCPT
TO:<([a-zA-Z0-9\._\-]+)@([a-zA-Z0-9\._\-]+)>/i) {
#@4000000043a1c3a908438ffc 7905 dispatching MAIL
FROM:<[email protected]>
#@4000000043a1c3a908438ffc 7905 dispatching MAIL
FROM:<[email protected]>
if ($l =~ /@[0-9a-f]{24} \d+ dispatching MAIL
FROM:<([a-zA-Z0-9\._\-]+)@([a-zA-Z0-9\._\-]+)>/i) {
example from sqpmtpd:
2016-11-25 20:30:49.639012500 4745 dispatching EHLO [IP]
2016-11-25 20:30:50.791333500 4745 dispatching MAIL
FROM:<[email protected]>
2016-11-25 20:30:51.053517500 4745 dispatching RCPT TO:<[email protected]>
2016-11-25 20:30:51.108029500 4745 dispatching RCPT TO:<[email protected]>
2016-11-25 20:30:51.109154500 4745 dispatching RCPT TO:<[email protected]>
2016-11-25 20:30:51.110252500 4745 dispatching DATA
2016-11-25 20:31:52.852846500 4745 dispatching QUIT
will count 1 in and 3 out .... and if a filter block the reception after theses
4 lines, the In and OUT are accounted ... so this means nothing.
What I suggest it to only look at qmail log for remote and local delivery
cat /var/log/qmail/current |tai64nlocal |grep 'to remote'
cat /var/log/qmail/current |tai64nlocal |grep 'to local'
the only limit I see is that it will take into account every fail attempt to
deliver one mail ... unless parsing also following lines under to check for
success. However, even if we do not do this las part this will be an
improvement, and recieving an alert for too many outgoing mail due to delivery
failure is not a bad thing ! We want the admin to check what is happening ! we
will also be bale to get mail bombing on an unsecure php script there.
I would like however to add a new RRD db and graph for qpsmtpd and accounting
for
- logging::logterse plugin line checking rejected / accepted incoming email and
reason for rejection
016-11-27 08:29:55.266015500 11249 logging::logterse plugin (deny): `
209.212.147.172 mail14.regnetwork8852.com mail14.regnetwork8852.com
<[email protected]> rhsbl 901 Blocked,
regnetwork8852.com on lists [abuse], See: http://www.surbl.org/lists.html
msg denied before queued
would need to take some elements from the mailstat contrib for that...
--
You are receiving this mail because:
You are the QA Contact for the bug._______________________________________________
Mail for each SME Contribs bug report
To unsubscribe, e-mail [email protected]
Searchable archive at https://lists.contribs.org/mailman/public/contribteam/
