Logging rejected Mails

[Michael Holzt]

I like to log mails i rejected for content reasons (virus, spam score). But
as i do not want to crank up loglevel (and this would also not give a nice
compact log entry), i modified both clamav and spamassassin to make a log
entry with an configurable priority (configure in 'loglevel_reject').
Example logs look like this:

Sep 19 13:36:58 zeus qpsmtpd: 12994 virus::clamav plugin: Rejected Virus: 
  from <[EMAIL PROTECTED]> rcpt <[EMAIL PROTECTED]> 
  client mir.nadeshda.org[217.160.208.52] reason Worm.Bagle.Gen-1

Sep 19 13:39:03 zeus qpsmtpd: 13057 spamassassin plugin: Rejected Spam: 
  from <[EMAIL PROTECTED]> rcpt <[EMAIL PROTECTED]> 
  client 61.251.10.176[61.251.10.176] score 8.1


-kju

-- 
      It's an insane world, but i'm proud to be a part of it. -- Bill Hicks

--- /home/kju/qpsmtpd-cvs/plugins/spamassassin  Sun Jul 18 13:02:24 2004
+++ spamassassin        Sun Sep 19 13:37:17 2004
@@ -179,8 +179,26 @@
   my $score = $self->get_spam_score($transaction) or return DECLINED;  
   $self->log(6, "check_spam_reject: score=$score");
 
-  return (DENY, "spam score exceeded threshold")
-    if $score >= $self->{_args}->{reject_threshold};
+  if ( $score >= $self->{_args}->{reject_threshold} )
+  {
+    my $loglevel = $self->qp->config('loglevel_reject');
+
+    if ( $loglevel )
+    {
+      my $logentry = 'Rejected Spam: from ' . $transaction->sender->format;
+      foreach my $recipient ( $transaction->recipients )
+      {
+        $logentry .= ' rcpt ' . $recipient->format;
+      }
+      $logentry .= ' client ' . $self->qp->connection->remote_host . '[' .
+        $self->qp->connection->remote_ip . ']';
+      $logentry .= ' score ' . $score;
+
+      $self->log($loglevel, $logentry);
+    }
+
+    return (DENY, "spam score exceeded threshold")
+  }
 
   $self->log(6, "check_spam_reject: passed");
   return DECLINED;

--- /home/kju/qpsmtpd-cvs/plugins/virus/clamav  Sun Jul 18 01:31:40 2004
+++ clamav      Sun Sep 19 13:37:17 2004
@@ -166,6 +166,22 @@
         $transaction->header->add('X-Virus-Found', 'Yes');
         $transaction->header->add('X-Virus-Details', $output);
     } else {
+        my $loglevel = $self->qp->config('loglevel_reject');
+
+        if ( $loglevel )
+        {
+          my $logentry = 'Rejected Virus: from ' . $transaction->sender->format;
+          foreach my $recipient ( $transaction->recipients )
+          {
+            $logentry .= ' rcpt ' . $recipient->format;
+          }
+          $logentry .= ' client ' . $self->qp->connection->remote_host . '[' .
+            $self->qp->connection->remote_ip . ']';
+          $logentry .= ' reason ' . $output;
+
+          $self->log($loglevel, $logentry);
+        }
+
         return (DENY, "Virus Found: $output");
     }
   }