Felix Buenemann wrote:
> Hi Eric,
> 
> Am 20.10.2008 20:01 Uhr, Eric Shubert schrieb:
>> BTW, couldn't the script simply test for "@" in the first position of 
>> any line to determine that it's not a syslog, so the flag wouldn't be 
>> necessary? Seems simpler to me.
> This was done to avoid a performance hit of about 20% caused by the more
> complex regex. However I've now rewritten the detection code, so it's
> much faster, so the attached version no longer needs (or supports) the
> --(no)syslog switch.
> 
>> -- -Eric 'shubes'
> -- Felix
> 

Nice. Here's my present result, for all logs:
# time cat /var/log/qmail/smtp/*.s | ./spamdyke-stats.pl
34229   DENIED_RDNS_MISSING
26702   DENIED_IP_IN_CC_RDNS
21848   DENIED_RBL_MATCH
-- Breakdown --
---------------
19514   ALLOWED
14910   DENIED_RDNS_RESOLVE
2684    DENIED_SENDER_NO_MX
2123    DENIED_OTHER
141     TIMEOUT
3       DENIED_TOO_MANY_RECIPIENTS

Allowed: 19514
Denied : 102499
Errors : 141
Total  : 122154
% Valid: 15.97%
% Spam : 83.91%
% Error: 0.12%

real    0m15.928s
user    0m4.512s
sys     0m3.616s


I'm a little confused by the Breakdown in the middle of results. Is the 
sort not working quite right? Here's what I'd prefer to see as output 
format:

spamdyke-stats.pl v???
Total  :  122154
Allowed:   19514  15.97%
Timeout:     141   0.12%
Denied :  102499  83.91%
____Denied Breakdown____
RDNS_MISSING         34229  33.39%
IP_IN_CC_RDNS        26702  26.05%
RBL_MATCH            21848  21.32%
RDNS_RESOLVE         14910  14.55%
SENDER_NO_MX          2684   2.62%
OTHER                 2123   2.07%
TOO_MANY_RECIPIENTS      3   0.00%

Or something along those lines. ;) Note the Denied percentages are 
percents of Denied, not percents of Total.

Thanks for your great work on this, Felix.

Oh, and one more thing just occurred to me. What about greylist 
rejections? I'm guessing that these numbers don't take greylisting into 
account. That would seem to be a bit complicated. Can someone think of a 
way to account for greylist rejections without complicating things too 
much? I wonder if Sam couldn't adjust the log messages in such a way 
that greylisting could be accounted for. Upon further thought, it seems 
to me that this subject might have been discussed before on the list. 
Sorry if I'm bringing up a dead horse.

-- 
-Eric 'shubes'

_______________________________________________
spamdyke-users mailing list
spamdyke-users@spamdyke.org
http://www.spamdyke.org/mailman/listinfo/spamdyke-users

Reply via email to