RE: [Qmail-scanner-general]Virus reporting

[CertaintyTech - Ed Henderson]

> > a quick-n-dirty start might be:
> >
> >   cat mailstats.csv|cut -f2,6|grep -v "Clear:"|uniq -c|sort -rn
>
> or something more fancy-schmancy
> (yet still crude enough to be of interest ;)
>


Many thanks to some of the tips that I received for creating a Virus Report that I can run periodically to notify my customers of what viruses have been stopped on their behalf.  I am planning to send this report monthly instead of notifying recipients in Q-S.  Here it is if anyones interested:

#!/bin/csh
#
# This script notifies customers of how many virus infected
# messages have been stopped for them
#
unset noclobber
set nonomatch

# grab local domains from virtualdomains file
set domains=`cat /var/qmail/control/virtualdomains|awk -F: '{print $1}'`
set VALIDDOMAINS=""
# string together the domain names to use with egrep
foreach domain (certainty.net $domains)
   if ("$VALIDDOMAINS" == "") then
      set VALIDDOMAINS="$domain"
   else
      set VALIDDOMAINS="$VALIDDOMAINS|$domain"
   endif
end
# create the virusreport logfile

# mailstats.csv.00 is the previous months Q-S log

# only grab the virus infected lines
cat /var/qmail/qmailscan/mailstats.csv.00|grep -v "Clear:" \
  |cut -f2,6|awk -F, '{print $1}' \
  |egrep "($VALIDDOMAINS)"|sort -rn \
  |uniq -c > /tmp/virusreport.log

#
# all of the sed stuff is to strip out junk that some virii

# add to email addresses - trying to reduce the amount of bounced

# messages.  BTW, "^E" is a CTRL-E
foreach user (`cat /tmp/virusreport.log|awk '{print $3}'|sed -e 's/<//g' -e 's/^E//g' -e 's/^3d//' -e 's/^3c//' -e 's/\&lt\;//g'|sort -u`)
   set mailfile=/tmp/virusreport.$user.$$
   echo 'From: "CertaintyTech VirusSTOP" <[EMAIL PROTECTED]>' > $mailfile
   echo "Subject: VirusSTOP report" >> $mailfile
   echo "Hello $user," >> $mailfile
   echo ""  >> $mailfile
   echo "You are receiving this message because you are using the Certainty Tech VirusSTOP service. This report is sent monthly to inform you of all virus infected emails that were stopped on your behalf during the last month. Here is the latest summary:" >> $mailfile
   echo "" >> $mailfile
   echo "Qty. Virus Name or Type">> $mailfile
   echo "==== ==================">> $mailfile

   # thats a TAB before the $user variable
   grep "    $user" /tmp/virusreport.log|cut -f0,1|sed -e 's/SOPHIE://g' -e 's/Perlscan://g' -e 's/Policy://g' >>& $mailfile
   echo "" >> $mailfile
   echo "" >> $mailfile
   echo "" >> $mailfile
   echo "Compliments of Certainty Tech Internet Service :-)" >> $mailfile

   # clean up
   /bin/mail -t $user < $mailfile
   /bin/rm -f $mailfile
   # echo Report sent to $user
end

# clean up
/bin/rm -f /tmp/virusreport.log