Robert thought of grep'ing for just the return codes, like
tail -f ~smtpd/qpsmtpd/log/main/current | egrep ' [45][[:digit:]][[:digit:]] | 250 Q'
The sad output of ~45 seconds in the middle of the night here is below. (Yes, I just started blocking people who keep sending "Incomplete DATA" as well).
- ask
@400000003f5847d9181926bc 25211 451 Incomplete DATA
@400000003f5847da23dbbdac 25213 451 Incomplete DATA
@400000003f5847db19dc2bac 25157 451 Incomplete DATA
@400000003f5847dd1b0244bc 25218 451 Incomplete DATA
@400000003f5847de1c122264 25104 451 Incomplete DATA
@400000003f5847df10cd98fc 25219 550 Blocked. Contact [EMAIL PROTECTED] Include this in the subject: 202.100.34.159
@400000003f5847e00f4602e4 25217 451 Incomplete DATA
@400000003f5847e0255267bc 25220 250 Queued! <[EMAIL PROTECTED]>
@400000003f5847e114067cdc 25221 550 Mail from test.com rejected because it does not accept bounces. This violates RFC 821/2505/2821 http://www.rfc-ignorant.org/
@400000003f5847e20065bcec 25222 550 Blocked. Contact [EMAIL PROTECTED] Include this in the subject: 211.189.80.1
@400000003f5847e216b9d154 25222 503 RCPT first
@400000003f5847e21d233c74 25219 503 RCPT first
@400000003f5847e514b6aa6c 25235 550 Blocked. Contact [EMAIL PROTECTED] Include this in the subject: 211.176.154.249
@400000003f5847e51e60a25c 25235 503 RCPT first
@400000003f5847e60977c654 25236 550 Blocked. Contact [EMAIL PROTECTED] Include this in the subject: 211.189.80.1
@400000003f5847e621129f14 25236 503 RCPT first
@400000003f5847e7104b228c 25237 451 Incomplete DATA
@400000003f5847ea03482bfc 25239 550 Blocked. Contact [EMAIL PROTECTED] Include this in the subject: 202.103.164.104
@400000003f5847ea11040a7c 25239 503 RCPT first
@400000003f5847ec0f996a74 25196 250 Queued! <[EMAIL PROTECTED]>
@400000003f5847ee3533c234 25241 451 Incomplete DATA
@400000003f5847ef0ffb29e4 25252 550 Blocked. Contact [EMAIL PROTECTED] Include this in the subject: 61.82.96.188
@400000003f5847ef1cf951fc 25252 503 RCPT first
@400000003f5847ef2491c354 25251 451 Incomplete DATA
@400000003f5847f00a220074 25240 451 Incomplete DATA
@400000003f5847f1309eccdc 25250 550 Mail from test.com rejected because it does not accept bounces. This violates RFC 821/2505/2821 http://www.rfc-ignorant.org/
@400000003f5847f4218c4f6c 25261 451 Incomplete DATA
@400000003f5847fa1795682c 25265 552 Klez Virus Detected
@400000003f5847ff2c13fd2c 25267 451 Incomplete DATA
@400000003f58480508b28e0c 25270 451 Incomplete DATA
@400000003f5848080abe733c 25271 550 Blocked. Contact [EMAIL PROTECTED] Include this in the subject: 202.100.34.159
@400000003f584808216b3aac 25271 503 RCPT first
@400000003f5848082a87a454 25272 451 Incomplete DATA
@400000003f58480a323af87c 25273 451 Incomplete DATA
@400000003f58480d1631638c 25275 550 Mail from [EMAIL PROTECTED] not accepted here
-- http://www.askbjoernhansen.com/
