On Thursday 22 Sep 2005 14:00, Jason S wrote:
> On 9/21/05, Bob Hutchinson <[EMAIL PROTECTED]> wrote:
> > On Wednesday 21 Sep 2005 18:29, Sloath wrote:
> > > Hi all,
> > >
> > > I have a system set-up according to the guide, with qmail logging using
> > > multilog to /var/log/qmail and using qmailmrtg7 for creating graphs.
> > >
> > > I've been investigating a few peaks in my messages/hour graph..
> > >
> > > Looking at the qmailmrtg7 code for counting messages... if increments a
> > > counter for every line that has a success, failure or deferral.
> > > Then at the end it returns two numbers, each multiplied by 12...
> > > (success*12, (failure+success)*12).
> > > It took me a few minutes to figure this out; it only counts messages
> > > from the last 300 seconds (5 minutes), and as we graph messages per
> > > hour it multiplies by 12 to get an hours worth... This turns 54
> > > messages in the last 5 minutes into a plot of 648 messages/hour.
> >
> > I found that out when I implemented a trigger on messages ;-)
> >
> > > So when interpreting the 5 minute average graph, you have to look at
> > > any peak and divide by 12, to get the actual number of messages sent in
> > > the 5 minutes it represents....
> > >
> > > Wouldn't it be of more use to graph messages/5 minutes or a running
> > > total of messages per hour based on the actual previous 12 5-minute
> > > totals?
> > >
> > > Has anyone patched qmailmrtg7.c to allow it to take into account
> > > CHKUSER rejecting messages when counting SMTP totals? At the moment it
> > > only counts tcpserver and rblsmtpd deny messages.
> >
> > hmm yes good point.
> >
> > > Would simply adding the following(before line 291) to qmailmrtg7.c
> > > cover this?
> > > if ((tmpstr1 = strstr(TmpBuf, "CHKUSER rejected rcpt"))!=NULL) {
> > > --tallow;
> > > ++tdeny;
> > > }
> >
> > I've added this to a copy of qmailmrtg7.c and ran make, fine, it's now
> > running, I'll watch the graph and see what happens, so far so good.
> >
> > A quick look at the qmail-smtpd log showed a 'CHKUSER rejected relaying'
> > so
> > I've changed the string to 'CHKUSER rejected' to catch them all
> >
> > It won't catch 'CHKUSER no auth resource' or 'CHKUSER mbx overquota' but
> > I've
> > never seen either in my logs and nor has logwatch.
> >
> > patch is attached
> >
> >
> > HTH
> > --
> > -----------------
> > Bob Hutchinson
> > Midwales dot com
> > -----------------
>
> Yes, I patched mine awhile back to give the 'actual' messages per 5 min
> interval instead of the 'hourly average' which is what it currently gives.
> Just took off the "*12". This seems to be a change in the most recent
> version(s) of qmailmrtg. I remember a year or so ago, it didn't do that...
>
> I think...qmailmrtg7-4.0 has '*12' in it, I don't know about older ones. Personally I don't mind the per hourly rate output, and it's easy enough to change. The CHKUSER issue is a problem for those using Tonito's patch though, thanks to Sloath for pointing it out. -- ----------------- Bob Hutchinson Midwales dot com -----------------
