[Mimedefang] graphdefang and mailing list activity

[Rich West]

I've been trying to tweak mimedefang to properly log all mailing list 
activity in order to get a better idea, through graphdefang, as to how 
much of the overall activity is due to the mailing lists.

I've gotten the mimedefang-filter set to identify mail coming *in* to 
the mailing lists and properly log it, but, as you know, the bulk of 
email with regards to mailing lists is email going *out* from mailing lists.

I thought of  putting something in to filter_sender, but then I backed 
off thinking that I might be opening up a rather large security hole.

I've since built a small snippet to be added to the end of filter_sender:
if (&is_list($sender) && ($hostip == "127.0.0.1")){
  md_graphdefang_log("mailing_list", , ,);
}
Where is_list is as below (with the %lists being a hash of all lists on 
the system).

sub is_list
{
  my($listname) = shift;
  ##
  ## The email address, as it comes in, is surrounded by
  ## brackets.  We have to massage it a little in order to do
  ## proper matching.  eg: '<[EMAIL PROTECTED]>' needs to be 'test'.
  ##
  $listname = (split("\@", $listname))[0];
  $listname = (split("\<", $listname))[1];
  return ($lists{lc($listname)});
}
However, if I remember correctly, the "from" addresses when dealing with 
mailing lists are not easily matched upon...   I think that is where my 
logic in this scenario starts to fade..

Thoughts/ideas?
-Rich
_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang