Jake Vickers wrote:
Javid Freeman wrote:
Ok, thanks... Could be a nice feature to add the option to install
*qmail-scanner ***with clamav, spamassassin and QmailToaster. I'm sure
you can install qmail-scanner and integrate with QmailToaster -- has
anyone tried?
http://qmail-scanner.sourceforge.net/
Looks like it's configured to run with Qmail 1.03 or Netqmail 1.05...
Javid
On 07/01/2009 08:15 PM, Eric Shubert wrote:
I'm afraid the toaster's logs are nowhere near that pretty. :(
qmlog command by itself shows all of the options. The smtp, spamd,
and clamd logs are each separate. I usually just tail the smtp log
for monitoring purposes. Most of what you're looking for is in there,
if not as pretty. ;)
I agree with Eric that the logging is not as pretty. It is readable
though; here is a sample from one of my machines:
2009-07-01 23:22:10.310372500 tcpserver: status: 3/255
2009-07-01 23:22:10.310607500 tcpserver: pid 12231 from 195.25.170.2
2009-07-01 23:22:10.310758500 tcpserver: ok 12231
mailserver.blah.com:164.127.118.179:25 :195.25.170.2::51864
2009-07-01 23:22:11.076299500 tcpserver: end 12230 status 0
2009-07-01 23:22:11.076326500 tcpserver: status: 2/255
2009-07-01 23:22:11.529857500 CHKUSER accepted sender: from
<[email protected]::> remote <pcjerome:unknown:195.25.170.2> rcpt
<> : sender accepted
2009-07-01 23:22:11.866180500 CHKUSER accepted rcpt: from
<[email protected]::> remote <pcjerome:unknown:195.25.170.2> rcpt
<[email protected]> : found existing recipient
2009-07-01 23:22:12.976282500 simscan:[12231]:CLEAN
(6.40/12.00):0.8616s:***SPAM*** Staying tool easy as 1,2,3 cuneiform
denominational:195.25.170.2:[email protected]:[email protected]:
2009-07-01 23:22:13.545616500 tcpserver: end 12231 status 0
You can see the message was accepted from 195.25.170.2, and simscan
scanned it and gave it a score of 6.40 with a threshold of 12.0 (when a
message gets deleted). Since it scored above 5.0 (defined in the
/etc/mail/spamassassin/local.cf config file), it was rewritten with the
subject of ***SPAM***.
And we use simscan instead of qmail-scanner. While qmail-scanner can be
more flexible, it does not run nearly as fast as simscan.
And once you install spamdyke, the smtp log becomes a little nicer
(without the line wrap):
07-02 08:57:27 tcpserver: status: 0/100
07-02 08:58:18 tcpserver: status: 1/100
07-02 08:58:18 tcpserver: pid 16133 from 72.232.191.34
07-02 08:58:18 tcpserver: ok 16133 doris.shubes:192.168.171.11:25
:72.232.191.34::52816
07-02 08:58:27 CHKUSER accepted sender: from
<[email protected]::> remote
<mx3.windyguide.com:unknown:72.232.191.34>
rcpt <> : sender accepted
07-02 08:58:27 tcpserver: status: 2/100
07-02 08:58:27 tcpserver: pid 16135 from 190.188.242.177
07-02 08:58:27 tcpserver: ok 16135 doris.shubes:192.168.171.11:25
:190.188.242.177::6837
07-02 08:58:28 DENIED_GRAYLISTED from: [email protected] to:
[email protected] origin_ip: 72.232.191.34 origin_rdns:
34.191.232.72.static.reverse.ltdomains.com auth: (unknown)
07-02 08:58:29 tcpserver: end 16133 status 0
07-02 08:58:29 tcpserver: status: 1/100
07-02 08:58:33 DENIED_IP_IN_CC_RDNS from: [email protected] to:
[email protected] origin_ip: 190.188.242.177 origi
n_rdns: 177-242-188-190.cab.prima.net.ar auth: (unknown)
07-02 08:58:33 DENIED_IP_IN_CC_RDNS from: [email protected] to:
[email protected] origin_ip: 190.188.242.177 orig
in_rdns: 177-242-188-190.cab.prima.net.ar auth: (unknown)
07-02 08:58:34 tcpserver: end 16135 status 0
07-02 08:58:34 tcpserver: status: 0/100
Spamdyke does a great job with logging. With its detailed logging (for
debugging only), you won't need to mess with recordio any more either.
It provides detail recording of the smtp session much like recordio, but
it puts each session in a separate file so logs are a breeze to read.
--
-Eric 'shubes'
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
