On Thu, 2012-02-23 at 18:47 +0100, Amedeo Rinaldo wrote: > Il 23/02/2012 13:49, Martin Gregorie ha scritto: > > On Thu, 2012-02-23 at 08:49 +0100, Amedeo Rinaldo wrote: > >> Is there a way/rule to count the fired ruled number ? > >> ..[cut].. > >> > > If you just want to see what rules fire within a period of time and/or > > count them, scan the mail log (/etc/log/maillog*) on my system. A good > > approach for daily reporting is to write a logwatch extension module, > > probably in Perl. Otherwise, write a standalone analyser in Perl, awk or > > the language of your choice. > > I went the logwatch route but also have a scripts that can scan all > > available mail logs, analyse SA performance, message sizes, etc. > > Martin > > > Thanks Martin, but I mean a 'live rule' to count fired rules ..not a > post log operation. > > I need somthing like.. > > > [BAYES_00=-2.5, SPF_NEUTRAL=0.1] > > ___FIRED_RULES=2 > OK, I understand that, but not why you need the information while the message is being scanned.
If you want to gather stats on rule hits vs. senders or sending domains you can get that from the maillog provided you put a simple filter in the pipe that counts the rules that fired for each message, extracts anything else you need from the message headers and logs the result. I do more or less that at present: I have a spam deletion program downstream of spamc which also logs the sender, subject, custom rules hit and what was done with the message (passed to Postfix, deleted or quarantined). A custom logwatch module analyses the maillog and generates a spam stats report showing the ham:spam ratio for the day and a top 10 for custom rules that fired. Martin
