RE: [Declude.JunkMail] \spool\charset directory
this is a test in declude.cfg and there is nowhere where I am setting up that directory. I guess it is by defaults. I just do not want to see 100s of thousands emails in a directory nor do I feel like personally managing it. I am not the greatest with scripts either. These kinds of controls I would like to see in Declude itself. In a gui interface by the way! Harry Vanderzand inTown Internet & Computer Services 519-741-1222 _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, December 12, 2006 6:45 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] \spool\charset directory Harry, check your global.cfg and see if you have a test with a COPYTO action that copies the email to that spool\charset folder when the test is triggered. Then comment out that test and action. Andrew. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Tuesday, December 12, 2006 2:39 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] \spool\charset directory The spool\charset directory is filling up with thousands of e-mails per day. Can that be stopped? while still keeping the bancharset command? Harry Vanderzand inTown Internet & Computer Services 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] \spool\charset directory
Harry, check your global.cfg and see if you have a test with a COPYTO action that copies the email to that spool\charset folder when the test is triggered. Then comment out that test and action. Andrew. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Tuesday, December 12, 2006 2:39 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] \spool\charset directory The spool\charset directory is filling up with thousands of e-mails per day. Can that be stopped? while still keeping the bancharset command? Harry Vanderzand inTown Internet & Computer Services 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] \spool\charset directory
The spool\charset directory is filling up with thousands of e-mails per day. Can that be stopped? while still keeping the bancharset command? Harry Vanderzand inTown Internet & Computer Services 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Reporting Tool
Try dragging down the script again. Maybe it didn't copy right to your HD ? Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Lists - Declude JunkMail Sent: Tuesday, December 12, 2006 3:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New Reporting Tool I've got ActiveState Perl 5.8.8 bld 819 installed and working. I use perl for all sorts of other scripts with no issues. I'm not sure what Regex is. I thought it was part of your code. I don't see a perl package install called Regex. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Posted At: Monday, December 11, 2006 4:33 PM Posted To: Lists - Declude JunkMail Conversation: [Declude.JunkMail] New Reporting Tool Subject: RE: [Declude.JunkMail] New Reporting Tool What's Regex ? Do you have PERL installed ? A 20 meg log file shouldn't matter... Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Lists - Declude JunkMail Sent: Thursday, December 07, 2006 4:29 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New Reporting Tool Thanks so much for this! I tried it out and it errors out as follows: File path : g:/logarchive/ Processing a single day Opening File : g:/logarchive/dec1206.log . Sorting arrays and cleaning up data Unmatched [ in regex; marked by <-- HERE in m/[ <-- HERE weight/ at f:\tools\dis tro-declog.pl line 443. My log is 20mb if that matters. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Posted At: Thursday, December 07, 2006 1:53 PM Posted To: Lists - Declude JunkMail Conversation: New Reporting Tool Subject: [Declude.JunkMail] New Reporting Tool The newest PERL script. Slices, dices, etc ... Throw it in a directory, edit a few environment variables at the top of the script, dump in a few Declude logs, run it, enjoy. Requires PERL, of course. Added two command line switches : 'day' and 'week' . Day does the previous day, week does the previous week. No command line switch, and you do all the logs in the directory. This can be memory intensive... You have been warned ! My own server, with 11-13k log files, consumes 700+ megs of memory when doing an entire month. Folks with larger files might want to think about doing this many files at once. Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Reporting Tool
The error means that the Perl interpreter thought that there was a
regular expression (hence, "regex") at line 443 which had an unmatched
square bracket. I don't see anything wrong with the line 443 in Karl's
posting, nor do I see what should have been a regular expression, in
that line, which I see as:
if ( $DupeHolder =~ $sortedcleanedtests[$placecounter] ) {
I hope that helps the two of you get on the same page...
Andrew 8)
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Lists - Declude JunkMail
Sent: Thursday, December 07, 2006 1:29 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New Reporting Tool
Thanks so much for this!
I tried it out and it errors out as follows:
File path : g:/logarchive/
Processing a single day
Opening File : g:/logarchive/dec1206.log
.
Sorting arrays and cleaning up data
Unmatched [ in regex; marked by <-- HERE in m/[ <-- HERE weight/
at f:\tools\dis
tro-declog.pl line 443.
My log is 20mb if that matters.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of IS - Systems Eng. (Karl Drugge)
Posted At: Thursday, December 07, 2006 1:53 PM
Posted To: Lists - Declude JunkMail
Conversation: New Reporting Tool
Subject: [Declude.JunkMail] New Reporting Tool
The newest PERL script. Slices, dices, etc ... Throw it in a
directory, edit a few environment variables at the top of the script,
dump in a few Declude logs, run it, enjoy. Requires PERL, of course.
Added two command line switches : 'day' and 'week' . Day does
the previous day, week does the previous week. No command line switch,
and you do all the logs in the directory. This can be memory
intensive... You have been warned ! My own server, with 11-13k log
files, consumes 700+ megs of memory when doing an entire month. Folks
with larger files might want to think about doing this many files at
once.
Karl Drugge
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] blklst ON statistics...
Thanks, got it, the original email I saw said global.cfg - working now. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, December 12, 2006 3:26 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] blklst ON statistics... It should be in the declude.cfg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ken Weise Sent: Tuesday, December 12, 2006 3:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] blklst ON statistics... What was the trick to getting the blacklist text file working? I haven't been able to get it to output anything. Running Declude 4.3.23 for Smartermail. I put the "BLKLST ON" in the global.cfg, right place? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Tuesday, December 12, 2006 9:14 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] blklst ON statistics... Interesting.. I ran some scripts against the blklst.txt file, and it shows I am already blocking the most active connections. About the only thing I can really see, is that the SPAM is coming from hundreds of IP's, with only a few from each one. I was kind of shocked by the extent of it, figuring that I'd see numerous IP's over 100 in a 12 hour period. But 8300+ IP's, and only 10 or so above 10 connections. Wow. Talk about distributed ! Script attached, PERL again, edit the top to fit your environment, as usual. Output below.. Total IP's : 8381 HitsIP Address HostName 54 61.50.229.194 61.50.229.194 --- 25 70.108.157.156 pool-70-108-157-156.washdc.east.verizon.net --- 23 82.173.173.230 ip230-173-173-82.adsl2.versatel.nl --- 22 151.49.24.185 adsl-ull-185-24.49-151.net24.it --- 22 88.154.136.186 bzq-88-154-136-186.red.bezeqint.net --- 14 202.175.165.198n17z165l198.broadband.ctm.net --- 12 66.151.234.151 ccm14.constantcontact.com --- 11 59.115.100.197 59-115-100-197.dynamic.hinet.net --- 11 66.151.234.153 ccm16.constantcontact.com --- 8 201.9.194.141 201009194141.user.veloxzone.com.br --- 8 213.207.242.147 213.207.242.147 --- 8 220.133.25.238 220-133-25-238.hinet-ip.hinet.net --- 8 66.91.4.132 cpe-66-91-4-132.hawaii.res.rr.com --- 7 169.139.180.120 mail.scps.k12.fl.us --- 7 202.175.95.171 z95l171.static.ctm.net --- 7 219.155.156.139 hn.kd.pix --- 7 66.104.31.195 ip66-104-31-195.z31-104-66.customer.algx.net --- 6 125.33.74.167 125.33.74.167 --- 6 208.254.21.131 crozier.missingkids.com --- 6 222.217.118.250 222.217.118.250 --- 6 59.45.98.25559.45.98.255 --- Karl Drugge B.S.I.T., A.S., M.C.S.E. (NT 4, 2k, 2k3), M.C.S.A. (2k + 2k3), C.C.N.A., Network+, A+ I dream of the day when I will learn to stop asking questions to which I will regret learning the answers ( Roy Greenhilt, Order of the Stick ) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] blklst ON statistics...
It should be in the declude.cfg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ken Weise Sent: Tuesday, December 12, 2006 3:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] blklst ON statistics... What was the trick to getting the blacklist text file working? I haven't been able to get it to output anything. Running Declude 4.3.23 for Smartermail. I put the "BLKLST ON" in the global.cfg, right place? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Tuesday, December 12, 2006 9:14 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] blklst ON statistics... Interesting.. I ran some scripts against the blklst.txt file, and it shows I am already blocking the most active connections. About the only thing I can really see, is that the SPAM is coming from hundreds of IP's, with only a few from each one. I was kind of shocked by the extent of it, figuring that I'd see numerous IP's over 100 in a 12 hour period. But 8300+ IP's, and only 10 or so above 10 connections. Wow. Talk about distributed ! Script attached, PERL again, edit the top to fit your environment, as usual. Output below.. Total IP's : 8381 HitsIP Address HostName 54 61.50.229.194 61.50.229.194 --- 25 70.108.157.156 pool-70-108-157-156.washdc.east.verizon.net --- 23 82.173.173.230 ip230-173-173-82.adsl2.versatel.nl --- 22 151.49.24.185 adsl-ull-185-24.49-151.net24.it --- 22 88.154.136.186 bzq-88-154-136-186.red.bezeqint.net --- 14 202.175.165.198n17z165l198.broadband.ctm.net --- 12 66.151.234.151 ccm14.constantcontact.com --- 11 59.115.100.197 59-115-100-197.dynamic.hinet.net --- 11 66.151.234.153 ccm16.constantcontact.com --- 8 201.9.194.141 201009194141.user.veloxzone.com.br --- 8 213.207.242.147 213.207.242.147 --- 8 220.133.25.238 220-133-25-238.hinet-ip.hinet.net --- 8 66.91.4.132 cpe-66-91-4-132.hawaii.res.rr.com --- 7 169.139.180.120 mail.scps.k12.fl.us --- 7 202.175.95.171 z95l171.static.ctm.net --- 7 219.155.156.139 hn.kd.pix --- 7 66.104.31.195 ip66-104-31-195.z31-104-66.customer.algx.net --- 6 125.33.74.167 125.33.74.167 --- 6 208.254.21.131 crozier.missingkids.com --- 6 222.217.118.250 222.217.118.250 --- 6 59.45.98.25559.45.98.255 --- Karl Drugge B.S.I.T., A.S., M.C.S.E. (NT 4, 2k, 2k3), M.C.S.A. (2k + 2k3), C.C.N.A., Network+, A+ I dream of the day when I will learn to stop asking questions to which I will regret learning the answers ( Roy Greenhilt, Order of the Stick ) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3.24 AVG Interim
David, I am on 4.3.23, but have always used the upgrade version so my built in anti virus is not installed I need help installing it whithout changing my other configs is there a link or should i open a support ticket ? TIA - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: ; Sent: Tuesday, December 12, 2006 5:21 PM Subject: [Declude.JunkMail] Declude 4.3.24 AVG Interim > This version is available as an interim release, for those of you who have > the login to interim, it is the same, be sure to download your appropriate > decludeproc and the avgsdk.dll. If want to try the interim release email me > directly. > > David Barker > Director of Product Management > Your Email security is our business > 978.499.2933 office > 978.988.1311 fax > [EMAIL PROTECTED] > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] blklst ON statistics...
Place it in the Declude.cfg, restart the proc service >What was the trick to getting the blacklist text file working? I haven't >been able to get it to output anything. Running Declude 4.3.23 for >Smartermail. I put the "BLKLST ON" in the global.cfg, right place? Chris Asaro Technical Support Engineer Declude Your Email security is our business 866.332.5833 toll free 978.499.2933 office 978.477.8930 e-fax [EMAIL PROTECTED] www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ken Weise Sent: Tuesday, December 12, 2006 3:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] blklst ON statistics... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Tuesday, December 12, 2006 9:14 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] blklst ON statistics... Interesting.. I ran some scripts against the blklst.txt file, and it shows I am already blocking the most active connections. About the only thing I can really see, is that the SPAM is coming from hundreds of IP's, with only a few from each one. I was kind of shocked by the extent of it, figuring that I'd see numerous IP's over 100 in a 12 hour period. But 8300+ IP's, and only 10 or so above 10 connections. Wow. Talk about distributed ! Script attached, PERL again, edit the top to fit your environment, as usual. Output below.. Total IP's : 8381 HitsIP Address HostName 54 61.50.229.194 61.50.229.194 --- 25 70.108.157.156 pool-70-108-157-156.washdc.east.verizon.net --- 23 82.173.173.230 ip230-173-173-82.adsl2.versatel.nl --- 22 151.49.24.185 adsl-ull-185-24.49-151.net24.it --- 22 88.154.136.186 bzq-88-154-136-186.red.bezeqint.net --- 14 202.175.165.198n17z165l198.broadband.ctm.net --- 12 66.151.234.151 ccm14.constantcontact.com --- 11 59.115.100.197 59-115-100-197.dynamic.hinet.net --- 11 66.151.234.153 ccm16.constantcontact.com --- 8 201.9.194.141 201009194141.user.veloxzone.com.br --- 8 213.207.242.147 213.207.242.147 --- 8 220.133.25.238 220-133-25-238.hinet-ip.hinet.net --- 8 66.91.4.132 cpe-66-91-4-132.hawaii.res.rr.com --- 7 169.139.180.120 mail.scps.k12.fl.us --- 7 202.175.95.171 z95l171.static.ctm.net --- 7 219.155.156.139 hn.kd.pix --- 7 66.104.31.195 ip66-104-31-195.z31-104-66.customer.algx.net --- 6 125.33.74.167 125.33.74.167 --- 6 208.254.21.131 crozier.missingkids.com --- 6 222.217.118.250 222.217.118.250 --- 6 59.45.98.25559.45.98.255 --- Karl Drugge B.S.I.T., A.S., M.C.S.E. (NT 4, 2k, 2k3), M.C.S.A. (2k + 2k3), C.C.N.A., Network+, A+ I dream of the day when I will learn to stop asking questions to which I will regret learning the answers ( Roy Greenhilt, Order of the Stick ) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Reporting Tool
I've got ActiveState Perl 5.8.8 bld 819 installed and working. I use perl for all sorts of other scripts with no issues. I'm not sure what Regex is. I thought it was part of your code. I don't see a perl package install called Regex. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Posted At: Monday, December 11, 2006 4:33 PM Posted To: Lists - Declude JunkMail Conversation: [Declude.JunkMail] New Reporting Tool Subject: RE: [Declude.JunkMail] New Reporting Tool What's Regex ? Do you have PERL installed ? A 20 meg log file shouldn't matter... Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Lists - Declude JunkMail Sent: Thursday, December 07, 2006 4:29 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New Reporting Tool Thanks so much for this! I tried it out and it errors out as follows: File path : g:/logarchive/ Processing a single day Opening File : g:/logarchive/dec1206.log . Sorting arrays and cleaning up data Unmatched [ in regex; marked by <-- HERE in m/[ <-- HERE weight/ at f:\tools\dis tro-declog.pl line 443. My log is 20mb if that matters. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Posted At: Thursday, December 07, 2006 1:53 PM Posted To: Lists - Declude JunkMail Conversation: New Reporting Tool Subject: [Declude.JunkMail] New Reporting Tool The newest PERL script. Slices, dices, etc ... Throw it in a directory, edit a few environment variables at the top of the script, dump in a few Declude logs, run it, enjoy. Requires PERL, of course. Added two command line switches : 'day' and 'week' . Day does the previous day, week does the previous week. No command line switch, and you do all the logs in the directory. This can be memory intensive... You have been warned ! My own server, with 11-13k log files, consumes 700+ megs of memory when doing an entire month. Folks with larger files might want to think about doing this many files at once. Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] blklst ON statistics...
What was the trick to getting the blacklist text file working? I haven't been able to get it to output anything. Running Declude 4.3.23 for Smartermail. I put the "BLKLST ON" in the global.cfg, right place? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Tuesday, December 12, 2006 9:14 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] blklst ON statistics... Interesting.. I ran some scripts against the blklst.txt file, and it shows I am already blocking the most active connections. About the only thing I can really see, is that the SPAM is coming from hundreds of IP's, with only a few from each one. I was kind of shocked by the extent of it, figuring that I'd see numerous IP's over 100 in a 12 hour period. But 8300+ IP's, and only 10 or so above 10 connections. Wow. Talk about distributed ! Script attached, PERL again, edit the top to fit your environment, as usual. Output below.. Total IP's : 8381 HitsIP Address HostName 54 61.50.229.194 61.50.229.194 --- 25 70.108.157.156 pool-70-108-157-156.washdc.east.verizon.net --- 23 82.173.173.230 ip230-173-173-82.adsl2.versatel.nl --- 22 151.49.24.185 adsl-ull-185-24.49-151.net24.it --- 22 88.154.136.186 bzq-88-154-136-186.red.bezeqint.net --- 14 202.175.165.198n17z165l198.broadband.ctm.net --- 12 66.151.234.151 ccm14.constantcontact.com --- 11 59.115.100.197 59-115-100-197.dynamic.hinet.net --- 11 66.151.234.153 ccm16.constantcontact.com --- 8 201.9.194.141 201009194141.user.veloxzone.com.br --- 8 213.207.242.147 213.207.242.147 --- 8 220.133.25.238 220-133-25-238.hinet-ip.hinet.net --- 8 66.91.4.132 cpe-66-91-4-132.hawaii.res.rr.com --- 7 169.139.180.120 mail.scps.k12.fl.us --- 7 202.175.95.171 z95l171.static.ctm.net --- 7 219.155.156.139 hn.kd.pix --- 7 66.104.31.195 ip66-104-31-195.z31-104-66.customer.algx.net --- 6 125.33.74.167 125.33.74.167 --- 6 208.254.21.131 crozier.missingkids.com --- 6 222.217.118.250 222.217.118.250 --- 6 59.45.98.25559.45.98.255 --- Karl Drugge B.S.I.T., A.S., M.C.S.E. (NT 4, 2k, 2k3), M.C.S.A. (2k + 2k3), C.C.N.A., Network+, A+ I dream of the day when I will learn to stop asking questions to which I will regret learning the answers ( Roy Greenhilt, Order of the Stick ) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] log change desired.
Scott, I have added this to the wish list. David B www.declude.com _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Monday, December 11, 2006 6:00 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] log change desired. I loaded up Declude 4.3.23. I've noticed these lines are new in the HIGH level log file: 12/11/2006 10:08:39.624 q828301da0022.smd IP 72.32.59.13 not in whitelist (192.168.11.2). nm= with a separate line for each whitelist IP. I have 32 whitelisted IP's and to get 32 extra log lines for each mail isn't really desired. This log line should be for DEBUG level only. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] blklst ON statistics...
Interesting.. I ran some scripts against the blklst.txt file, and it shows I am already blocking the most active connections. About the only thing I can really see, is that the SPAM is coming from hundreds of IP's, with only a few from each one. I was kind of shocked by the extent of it, figuring that I'd see numerous IP's over 100 in a 12 hour period. But 8300+ IP's, and only 10 or so above 10 connections. Wow. Talk about distributed ! Script attached, PERL again, edit the top to fit your environment, as usual. Output below.. Total IP's : 8381 HitsIP Address HostName 54 61.50.229.194 61.50.229.194 --- 25 70.108.157.156 pool-70-108-157-156.washdc.east.verizon.net --- 23 82.173.173.230 ip230-173-173-82.adsl2.versatel.nl --- 22 151.49.24.185 adsl-ull-185-24.49-151.net24.it --- 22 88.154.136.186 bzq-88-154-136-186.red.bezeqint.net --- 14 202.175.165.198n17z165l198.broadband.ctm.net --- 12 66.151.234.151 ccm14.constantcontact.com --- 11 59.115.100.197 59-115-100-197.dynamic.hinet.net --- 11 66.151.234.153 ccm16.constantcontact.com --- 8 201.9.194.141 201009194141.user.veloxzone.com.br --- 8 213.207.242.147 213.207.242.147 --- 8 220.133.25.238 220-133-25-238.hinet-ip.hinet.net --- 8 66.91.4.132 cpe-66-91-4-132.hawaii.res.rr.com --- 7 169.139.180.120 mail.scps.k12.fl.us --- 7 202.175.95.171 z95l171.static.ctm.net --- 7 219.155.156.139 hn.kd.pix --- 7 66.104.31.195 ip66-104-31-195.z31-104-66.customer.algx.net --- 6 125.33.74.167 125.33.74.167 --- 6 208.254.21.131 crozier.missingkids.com --- 6 222.217.118.250 222.217.118.250 --- 6 59.45.98.25559.45.98.255 --- Karl Drugge B.S.I.T., A.S., M.C.S.E. (NT 4, 2k, 2k3), M.C.S.A. (2k + 2k3), C.C.N.A., Network+, A+ I dream of the day when I will learn to stop asking questions to which I will regret learning the answers ( Roy Greenhilt, Order of the Stick ) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. decblklst.pl Description: decblklst.pl
