Topic: qpsmtpd stats

[JonB]

I have my SME7pre3 server set up to act as a secondary MX for a mail server I look after in the States that gets hammered with spam.

The qpsmtpd stats for the past 24 hrs on the secondary MX are below

6266 - Total SMTP Connections
5138 - Total Rejected - made up of

9 virus::pattern_filter, hook data_post returned DENY
28 virus::clamav, hook data_post returned DENY
54 check_goodrcptto, hook rcpt returned DENY
96 dnsbl, hook rcpt returned DENY
770 check_basicheaders, hook data_post returned DENY
3812 spamassassin, hook data_post returned DENY
158 check_earlytalker, hook connect returned DENYSOFT

I made some ugly scripts using cat, grep, sed, uniq and sort  plus some manual copying and pasting to get the above stats and there must be a better way.

Anyone know of a better way to collect stats from logfiles and perhaps use rrd to create graphs.

There is a stats plugin for qpsmtpd but a night using google and searching the qpsmtpd newsgroup has not come up with instruction for utilizing it. The amount of documentation for qpsmtpd is very sparse.

Jon

[mdo]

Jon,

an older posting from Gordon (cannot find it at the moment) pointed to that one: http://www.hjp.at/projekte/qpsmtpd/log-tools/

There are 2 scripts for most of the job I believe:

'collapse_qpsmtpd_conn' which says in it's description:

=DESCRIPTION

collapse_qpsmtpd_conn extracts commands and responses from qpsmtpd log
files and prints a single line for each connection with the entire SMTP
dialog. The output is intended to be easily filtered with grep or awk.

Connections are identified by their PID. To avoid concatenating two
connections with the same PID only state about the last 100 connections
is kept.

The output also can be used as the input for the second script 'transaction-results'. According to the website, this script creates the nice output.

I have played with the first script and that was easy to run and it's output I believe should be much easier to be used (but I cannot do it .. not good enough). Thinking to automate this, I am unclear how to integrate this with the log rotation?

I gave up when trying to use the second script due to it's dependencies, etc.

If you can figure out more and believe it's a viable way to go, I am happy to try to help with testing if that would be of any help to you?

Michael (Tauranga)

[JonB]

Michael,

This might be a better option  http://stats.logidac.com/how/

It uses the two tools collapse_qpsmtpd_conn and a modified version of transaction-results form the site you mentioned.

Rather than create a Pie Chart it feeds the data to rrd to create charts like

http://stats.logidac.com/qpsmtpd.shtml

On another note, how did you get collapse_qpsmtpd_conn to work. Did you call it as a plugin or just run it as a script.

Do you need to run it with arguments.

Jon

[mdo]

This might be a better option http://stats.logidac.com/how/

I am not so sure about that to be a better option. I find it a bit too colourful.

On another note, how did you get collapse_qpsmtpd_conn to work. Did you call it as a plugin or just run it as a script.

Do you need to run it with arguments.

I ran it on the command line like:
./collapse_qpsmtpd_conn /var/log/qpsmtpd/current > /var/log/qpsmtpd-collapse1

Michael

[byte]

Guy's

Did you have any success with the transaction-results from here...

http://www.hjp.at/projekte/qpsmtpd/log-tools/

?

I'm interested

[Terry]

What about this?

http://mirror.contribs.org/smeserver/contribs/bread/mailstats/

(the mailstats cron)

It gives you a nice little email everyday at 12am.

[dmay]

What about this?

http://mirror.contribs.org/smeserver/contribs/bread/mailstats/

(the mailstats cron)

It gives you a nice little email everyday at 12am.

Even easier, I bundled this into an rpm and uploaded it to the Bug Tracker:

http://bugs.contribs.org/show_bug.cgi?id=819
http://bugs.contribs.org/attachment.cgi?id=577

Darrell

[byte]

What about this?

http://mirror.contribs.org/smeserver/contribs/bread/mailstats/

(the mailstats cron)

It gives you a nice little email everyday at 12am.

Thanks - I already saw this one and thought after seeing this topic a nice graph would be good.

Thanks for replying