Re: Logfile surveillance (Was: Re: LOTS of Orbs hits)

1999-06-08 Thread Peter van Dijk
On Tue, Jun 08, 1999 at 05:44:56PM -0700, Russ Allbery wrote: Lorens Kockum [EMAIL PROTECTED] writes: In fact, 'tail -f $FILE | less +F' is no good either. OK, so 'tail -f $FILE | grep $TRIGGERS', my xterm scrollbar, and a 'less' on the side will suffice until I get the time to patch

Re: LOTS of Orbs hits

1999-06-07 Thread ddb
Petr Novotny [EMAIL PROTECTED] writes on 7 June 1999 at 09:44:11 +0100 -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 What I want, of course, is the IP address the connect was from. Has anybody patched rblsmtpd to log that already? This is what I did: - --- cut here

Re: LOTS of Orbs hits

1999-06-07 Thread Petr Novotny
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 A little simpler than mine. I *think* x sometimes has the RBLSMTP environmnent variable rather than TCPREMOTEIP at that stage of the code; Can it? I must have missed that; anyway, it works for me since the only value RBLSMTP can have is "" for

Re: LOTS of Orbs hits

1999-06-07 Thread ddb
Petr Novotny [EMAIL PROTECTED] writes on 7 June 1999 at 16:50:05 +0100 -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 A little simpler than mine. I *think* x sometimes has the RBLSMTP environmnent variable rather than TCPREMOTEIP at that stage of the code; Can it? I must have

Logfile surveillance (Was: Re: LOTS of Orbs hits)

1999-06-07 Thread Lorens Kockum
On the qmail list [EMAIL PROTECTED] wrote: cat *|tailocal|grep orbs|less You launch that every few seconds or so? Or is that a 'less +F'? Does anyone know of a way to monitor a file for occurences of certain words? I tried 'tail -f $FILE | grep $TRIGGERS | less +F' but there seems to be a

Re: Logfile surveillance (Was: Re: LOTS of Orbs hits)

1999-06-07 Thread Dave Sill
[EMAIL PROTECTED] (Lorens Kockum) wrote: Does anyone know of a way to monitor a file for occurences of certain words? I tried 'tail -f $FILE | grep $TRIGGERS | less +F' Leave off the "| less +F". but there seems to be a stdin/stdout buffer in grep that delays the flow, so that the offending

Re: LOTS of Orbs hits

1999-06-06 Thread Paul Schinder
On 05 Jun 1999 21:49:04 -0700, Russ Allbery wrote: As a side note, I'd strongly recommend dumping ORBS in favor of a more ethical blackhole list. The maintainer of ORBS has gone on public record as blocking hosts because he "doesn't like their attitude," even if spam has never gone anywhere

Re: RRSS, was LOTS of Orbs hits

1999-06-06 Thread John R. Levine
I've heard good things about RRSS (URL:http://relays.radparker.com/) and the person running it certainly seems to be much calmer and more professional about it. I saw this site mentioned on the Tidbits Talk list about a week ago. I took a look, and I didn't see anything very useful. It looked to

Re: RRSS, was LOTS of Orbs hits

1999-06-06 Thread Paul Schinder
On 6 Jun 1999 13:23:01 -0400, John R. Levine wrote: I've heard good things about RRSS (URL:http://relays.radparker.com/) and the person running it certainly seems to be much calmer and more professional about it. I saw this site mentioned on the Tidbits Talk list about a week ago. I took a

Re: RRSS, was LOTS of Orbs hits

1999-06-06 Thread John R Levine
But how is this different from Vixie RBL, except for the openness check? RBL listings are entered manually, after live people review them, which takes a long time. RRSS runs automatically so listings are entered in real time. Or are you saying that if a site does spam but turns out not to

LOTS of Orbs hits

1999-06-05 Thread ddb
I'm getting LOTS of ORBS hits suddenly, like this: Jun 5 22:41:00 gw smtpd: 928640460.637397 rblsmtpd: pid 4196: 451 See http://www.orbs.org/blocked.cgi. Your mailserver is in the ORBS database as an insecure email relay. This is a generic text message. Jun 5 22:41:02 gw smtpd

Re: LOTS of Orbs hits

1999-06-05 Thread Adam D. McKenna
You might try using the -b flag with rblsmtpd, this will send 553 error code (permanent) instead of 451 (temporary).. --Adam On Sat, Jun 05, 1999 at 10:49:26PM -0500, [EMAIL PROTECTED] wrote: I'm getting LOTS of ORBS hits suddenly, like this: Jun 5 22:41:00 gw smtpd: 928640460.637397

Re: LOTS of Orbs hits

1999-06-05 Thread ddb
Adam D. McKenna [EMAIL PROTECTED] writes on 5 June 1999 at 23:51:49 -0400 You might try using the -b flag with rblsmtpd, this will send 553 error code (permanent) instead of 451 (temporary).. Yes, that would cure the problem I guess. 1 second seems awfully fast retry, I didn't think of it

Re: LOTS of Orbs hits

1999-06-05 Thread Russ Allbery
As a side note, I'd strongly recommend dumping ORBS in favor of a more ethical blackhole list. The maintainer of ORBS has gone on public record as blocking hosts because he "doesn't like their attitude," even if spam has never gone anywhere near them. I've heard good things about RRSS

Re: LOTS of Orbs hits

1999-06-05 Thread Bruce Guenter
On Sat, Jun 05, 1999 at 11:27:48PM -0500, [EMAIL PROTECTED] wrote: Yes, that would cure the problem I guess. 1 second seems awfully fast retry, I didn't think of it being just normal message retry. I seem to recall there being a bug in MSexchange that would cause it to immediately retry if it