I'm running qmail-scanner on an outbound relay in my network so that I can filter viruses out of my outbound queue and to prevent spewing them to the outside world.
I'm looking to find a corelation between the source IP of an email and the virus that was detected in it. I've been finding a few users infected with Gibe have been using our system as a smarthost, which I didn't think was normal behaviour for the virus, and I've seen instances where a single pc has been able to drive up our outbound queue by over 20000 messages in less than 30mins.
I'm assuming that I have to add something like $headers{'Received'} to the quarantine.log section, but I'm not sure exactly where/what. In my case the TCPREMOTEIP doesn't help since all connections are coming from the same IP. I need to extract the first Received IP from within the headers and get this into a log file that identifies a virus from them.
cheers
/jon
