Greetings: I found qmHandle which can give various statistics such as
/var/qmail/bin/qmHandle - s Total messages: 86 Messages with local recipients: 0 Messages with remote recipients: 82 Messages with bounces: 2 Messages in preprocess: 4 Now, if I wrote a script which took the above and created a log file which was formatted something like the below Mon Jul 20 10:02:19 EDT 2009 82 4 2 Where 82 was the number of remote recipients, 4 the number in preprocess, and 2 the number of bounces... how would I then have ossec alert if any of those three numbers jumped significantly? Thank you.
