From: Chris (no email)
Date: Mon Mar 01 2004 - 03:36:12 EST
Hi Marcel,
The first one would be wonderfull. In that case it would even be
readable by less-technical people.
Thanks,
Chris
On Sun, 2004-02-29 at 14:10, Marcel Weber wrote:
> Well what kind of summary? Say for example if a notification is
> triggered, that in the mail that goes to the recipient, there is a
> summary of what kind of virii the client sent / how many spam, etc?
>
> For example like this:
>
> **************************************************
> The client xyz exceeded the spam trigger:
>
> During the last 60 minutes it sent:
>
> 4 spam messages
>
> 2 virus infected messages
> (mydoom.b)
> (bagle.c)
>
> out of total 7 messages received
>
> The sender gets blocked for the next 60 minutes.
> ***************************************************
>
>
> But probably you'd like something like this:
>
> Feb 29 09:18:32 mail postfix/smtpd[5039]: connect from
> unknown[211.180.225.21]
> Feb 29 09:18:33 mail postfix/smtpd[5039]: DAE9F1D26:
> client=unknown[211.180.225.21]
> Feb 29 09:18:34 mail postfix/smtpd[5039]: reject: RCPT from
> unknown[211.180.225.
> 21]: 504 <K-ZONE11>: Helo command rejected: need fully-qualified
> hostname; from=<> to=<>
> Feb 29 09:18:40 mail postfix/smtpd[5039]: disconnect from
> unknown[211.180.225.21]
>
>
> *****************************************
> blablabla
>
> The sender got rejected 1 time(s) for [various reason]
>
> *****************************************
>
> Perhaps this is a dumb question: But to be sure if it's really the same
> connection we're tracking, is the number x in "postfix/smtpd[x]" unique
> for a connection, so that it can be used to track the connection?
>
>
> Marcel
>
>
> PS: I got a newer a bit more reliable version that I'm testing right
> now, as soon that I am happy with it I could post the code on the
> mailing list or perhaps better, post a link were one can download the
> beast...
>
>
>
|
|
|