On 09.10.2008 3:06 Uhr, slamp slamp wrote:
> where can i get this script?
Try the attached version.
-- Felix Buenemann
#!/usr/bin/perl -w
use diagnostics;
use strict;
use Getopt::Long;
my $tldtop = 0;
my $detailed = 1;
GetOptions ("tld=i" => \$tldtop,
"detail!" => \$detailed) or exit 1;
# Usage: # cat /var/log/qmail/smtpd/current | ./this_file
my %status = (); # hash of status connections
my %origin = (); # hash of tld per status code
my %originsum = (); # hash of tld per status code sums
my %rblstat = (); # hash of DNSBL lists matched
my %rhsblstat = (); # hash of RHSBL lists matched
my %rdnsblstat = (); # hash of patterns in IP_IN_RDNS_BLACKLIST matched
my ($allow, $deny, $error, $allowpercentage, $errorpercentage, $spampercentage,
$sum, $rblsum, $rhsblsum, $rdnsblsum);
$allow = 0;
while(<>){
my $line = $_;
if( m/spamdyke\[\d+\]: / ){
my ($a, $b, $c, $d) = split(/:/ , $line);
my ($e, $sdstatus) = split(/ /, $d);
#print "$b\n";
#next if $sdstatus eq "CHKUSER";
if( $sdstatus =~ m/FILTER_RBL_MATCH/ ){
$line =~ m/rbl: (\S+)/;
$rblstat{$1}++;
$rblsum++;
}
elsif( $sdstatus =~ m/FILTER_RHSBL_MATCH/ ){
$line =~ m/rhsbl: (\S+)/;
$rhsblstat{$1}++;
$rhsblsum++;
}
elsif( $sdstatus =~ m/FILTER_IP_IN_RDNS_BLACKLIST/ ){
$line =~ m/keyword: (\S+)/;
$rdnsblstat{$1}++;
$rdnsblsum++;
}
next if $sdstatus =~ m/CHKUSER|(FILTER|DEBUG|EXCESSIVE)_.*/;
$status{$sdstatus}++;
if($tldtop and $line =~ m/ origin_rdns: ([^ ]+)/) {
my $rdns = $1;
$originsum{$sdstatus}++;
if($rdns =~ m/^\(unknown\)$/){
#$origin{$sdstatus}{'unknown'}++;
next;
} elsif($rdns =~ m/\.(com|net)$/){
$origin{$sdstatus}{$1}++;
} elsif($rdns =~ m/\.([a-z]{2,2}\.[a-z]{2,2})$/){ #
co.uk
$origin{$sdstatus}{$1}++;
} elsif($rdns =~ m/\.([a-z]{2,})$/){ # de, ru, ...
$origin{$sdstatus}{$1}++
} else {
#$origin{$sdstatus}{'unknown'}++;
next;
}
}
}
}
foreach my $stat (sort keys %status){
if( $stat =~ m/ALLOWED/ ){
$allow = $status{$stat};
}
elsif( $stat =~ m/TIMEOUT|ERROR/ ){
$error += $status{$stat};
}
else{
$deny += $status{$stat};
}
}
$spampercentage = sprintf("%2.2f", ($deny/($allow+$error+$deny)*100) );
$errorpercentage = sprintf("%2.2f", ($error/($allow+$error+$deny)*100) );
$allowpercentage = sprintf("%2.2f", ($allow/($allow+$error+$deny)*100) );
foreach my $key (sort { $status{$b} <=> $status{$a} || $a cmp $b; } keys
%status){
print "$status{$key}\t$key\n";
if($detailed and $key eq "DENIED_RBL_MATCH" ){
print "-- Breakdown --\n";
foreach my $key (sort { $rblstat{$b} <=> $rblstat{$a} || $a cmp
$b; } keys %rblstat){
printf "%2.2f%%\t$key\n", ($rblstat{$key}/$rblsum*100);
}
print "---------------\n";
}
elsif($detailed and $key eq "DENIED_RHSBL_MATCH" ){
print "-- Breakdown --\n";
foreach my $key (sort { $rhsblstat{$b} <=> $rblstat{$a} || $a
cmp $b; } keys %rhsblstat){
printf "%2.2f%%\t$key\n",
($rhsblstat{$key}/$rhsblsum*100);
}
print "---------------\n";
}
elsif($detailed and $key eq "DENIED_IP_IN_RDNS" ){
print "-- Breakdown --\n";
foreach my $key (sort { $rdnsblstat{$b} <=> $rdnsblstat{$a} ||
$a cmp $b; } keys %rdnsblstat){
printf "%2.2f%%\t$key\n",
($rdnsblstat{$key}/$rdnsblsum*100);
}
print "---------------\n";
}
if($tldtop && $origin{$key}) {
my $top = $tldtop;
print "-- Top $top TLD --\n";
my $tldsum = 0;
my $lastsum = 0;
my @tldgroup = ();
my %neworigin = ();
foreach my $tld (sort { $origin{$key}{$a} <=> $origin{$key}{$b}
} keys %{$origin{$key}}){
if(($origin{$key}{$tld}/$originsum{$key}*100) ==
$lastsum) {
#print "push tldgroup, $tld
($origin{$key}{$tld})\n";
push(@tldgroup, $tld);
} else {
if(scalar @tldgroup) {
$neworigin{join(', ', @tldgroup)} =
$lastsum;
#print "tldgroup=". join(', ',
@tldgroup) ." ($lastsum)\n";
@tldgroup = ();
}
#print "push tldgroup, $tld
($origin{$key}{$tld})\n";
push(@tldgroup, $tld);
}
$lastsum = $origin{$key}{$tld}/$originsum{$key}*100;
$tldsum += $origin{$key}{$tld};
}
if(scalar @tldgroup) {
$neworigin{join(', ', @tldgroup)} = $lastsum * length
@tldgroup;
#print "tldgroup=". join(', ', @tldgroup) ."
($lastsum)\n";
}
foreach my $tld (sort { $neworigin{$b} <=> $neworigin{$a} }
keys %neworigin){
printf "%2.2f%%\t$tld\n", $neworigin{$tld};
last unless --$top;
}
#printf "%2.2f%%\t(unknown/illegal)\n",
(($originsum{$key}-$tldsum)/$originsum{$key}*100) if $tldsum &&
($originsum{$key}-$tldsum);
print "------------\n";
}
}
$sum = ($deny + $error + $allow);
print "\n";
print "Allowed: $allow \n";
print "Denied : $deny \n";
print "Errors : $error \n";
print "Total : $sum \n";
print "% Valid: $allowpercentage% \n";
print "% Spam : $spampercentage% \n";
print "% Error: $errorpercentage% \n";
_______________________________________________
spamdyke-users mailing list
spamdyke-users@spamdyke.org
http://www.spamdyke.org/mailman/listinfo/spamdyke-users
