On Thu, 2016-06-02 at 13:22 +0200, Antony Stone wrote: > On Thursday 02 June 2016 at 13:16:57, Martin Gregorie wrote: > > > On Thu, 2016-06-02 at 12:28 +0200, Matus UHLAR - fantomas wrote: > > > > Therefore I agree that there could be better way of noticing > admins > > > > of a [URIBL_BLOCKED] issue. > > > > create and install a logwatch service that scans /var/log/maillog > > for lines containing "URIBL_BLOCKED" - this involves a two line > config > > file and a scanner (a few lines of Perl). > > The problem I see with this, though, is that you have to know that > URIBL_BLOCKED is something sinister, and needs to be flagged as a > problem, to bother doing this. > Au contraire: the reason I suggested this implementing this approach and including the logwatch service in the standard SA package is that it gives a method of using an 'in your face' way of telling the sysadmin he has a problem: the logwatch display might say something like this:
***************************************************** ***************************************************** *** Spamassassin reported URIBL_BLOCKED 256 times *** ***************************************************** ****************** *********************************** This happened because URIBL received enough queries from the DNS you are using to exceed their free query limi t. If you own the DNS, you need to subscribe to the URIBL non-free service. If you don't own it, you must set up your own non-recursive DNS and make sure Spamassassin uses it. See *URL* for more details. ******** ********************************************* ************************** *************************** > It's probably less effort to actually set up a recursive local name > server, so anyone who knows about URIBL_BLOCKED will simply do this > instead. > Indeed, but by including such a logwatch service as part of the SA package you've provided a clue directly to SA newbies without having to explain the problem yet again on this mailing list. I'll even volunteer to write the logwatch service if none of the SA devs want to do it and we can agree the wording for its banner display. Martin
