Bill Landry wrote to Ryan Thompson:
----- Original Message -----
From: Ryan Thompson
Is there a way to generate a report from the AWL database that will
show senders and the score applied to their messages? When running SA
via amavisd-new, all I see in the headers is that the AWL test was
run, but not the actual score that was applies.
I used to use _TESTSSCORES_ in the Status header, but with
amavisd-new, I think you're in the same boat as MIMEDefang,
in that you have to generate your own headers. If you can
generate headers with scores, you'd be on your way.
However, there's also a little-known tool available in the tools/
directory of the SA distribution called check_whitelist, that will
do a dump of your AWL database. That may be all you need.
Thanks Ryan, that works. However, I have one more question about the AWL
dump output. Can someone explain what the first two columns means in this
output:
35.2 (35.2/4) -- [EMAIL PROTECTED]|ip=216.93
Sure. From the internal (perldoc) documentation:
OUTPUT
The output looks like this:
AVG (TOTSCORE/COUNT) -- EMAIL|ip=IPBASE
For example:
0.0 (0.0/7) -- [EMAIL PROTECTED]|ip=208.192
21.8 (43.7/2) -- [EMAIL PROTECTED]|ip=200.106
AVG is the average score; TOTSCORE is the total score of all mails
seen so far; COUNT is the number of messages seen from that sender;
EMAIL is the sender's email address, and IPBASE is the AWL base IP
address.
AWL base IP address is a way to identify the sender's IP address they
frequently send from, in an approximate way, but remaining hard for
spammers to spoof. The algorithm is as follows:
- take the last Received header that contains a public IP address --
namely
one which is not in private, unrouted IP space.
- chop off the last two octets, assuming that the user may be in an
ISP's
dynamic address pool.
Cheers,
- Ryan
--
Ryan Thompson <[EMAIL PROTECTED]>
SaskNow Technologies - http://www.sasknow.com
901-1st Avenue North - Saskatoon, SK - S7K 1Y4
Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon
Toll-Free: 877-727-5669 (877-SASKNOW) North America
