Zhiqiang::He

分析拒收邮件的日志分析程序
作者：Wietse Venema

Message 6 in thread
寄件者：Wietse Venema (wietse@porcupine.org)
主旨：Re: Freebsd Postifx Daily messages

View this article only
新闻群组：mailing.postfix.users
日期：2002-12-01 10:48:47 PST

Here's my own /etc/periodic/daily/460.status-mail-rejects script,
and yes it needs updating when logging formats change.

This script will not show rejected mail when the client never
returned after a soft (450) error code from the server. I use 450
for non-FQDN HELO hostnames, so that I can whitelist mis-configured
sites that aren't spammers.

Wietse

#!/bin/sh
# 

echo ""; echo "Scanning maillog for rejections:" 
zcat -fc /var/log/maillog.0* /var/log/maillog | egrep reject: | \
cut -d : -f 5- | sort | uniq -c | sort -nr | \
grep -v '^  *[1-2]  *[^ ]* [^ ]* from [^ ]*: 450 ' 

echo "";
echo "Scanning maillog for warnings:" 
zcat -fc /var/log/maillog.0* /var/log/maillog | egrep warning: | \
cut -d : -f 5- | sort | uniq -c 

print "";
echo "Scanning maillog for trouble:" 
zcat -fc /var/log/maillog.0* /var/log/maillog | egrep '(fatal|panic):' 

exit 

Post a follow-up to this message

一个简单的分析log的脚本
Author: Michael Tokarev

#!/bin/sh 
# Parses postfix style logs 

if [ $# -ne 2 ]; then 
 echo "Usage: `basename $0` logfile search-criteria" 
 exit 1 
fi 

TMPLOG="/tmp/`basename $0`.work.$$" 
MATCHES="/tmp/`basename $0`.matches.$$" 
LOGFILE="$1" 

if [ "${LOGFILE}" != "-" -a ! -f ${LOGFILE} ]; then 
 echo "File not found (${LOGFILE})" 
 exit 2 
fi 

if echo ${LOGFILE} │ egrep '\.bz2$' >/dev/null 2>&1; then 
 CAT="bunzip2 -c ${LOGFILE}" 
elif echo ${LOGFILE} │ egrep '\.(Z│gz)$' >/dev/null 2>&1; then 
 CAT="gunzip -c ${LOGFILE}" 
elif [ "${LOGFILE}" = "-" ]; then 
 cat > ${TMPLOG}.orig 
 CAT="cat ${TMPLOG}.orig" 
else 
 CAT="cat ${LOGFILE}" 
fi 

shift 

${CAT} │ egrep -i "$1" │ \ 
 awk '$9 ~ /^[A-Z0-9][A-Z0-9]*:$/ {print $1 " *" $2 ".*" $9}' > ${MATCHES} 
[ -s ${MATCHES} ] && ${CAT} │ egrep -i -f ${MATCHES} 

[ -f ${TMPLOG}.orig ] && rm ${TMPLOG}.orig 
[ -f ${TMPLOG} ] && rm ${TMPLOG} 
[ -f ${MATCHES} ] && rm ${MATCHES} 

exit 0

我写的一个简单邮件IN/OUT分析脚本
Author: hzqbbc

是参考了Wietse的reject 分析脚本后，得到启发写的，希望对用Postfix的朋友有点帮助。

#!/bin/bash
# mail-statistic.sh : 
# Simple script for analysis Postfix maillog 
# Version: 0.03 
# Author: hzqbbc@hzqbbc.com 
# 

RAN=`echo $RANDOM` 
echo "Mail log analysis ID is $RAN " 
echo "Checking ...................." 
echo "" 
echo "" 
# make a direcotry to contain temp log file 
mkdir $RAN 
cp /var/log/maillog $RAN/maillog 
zcat /var/log/maillog.*.gz >> $RAN/maillog 

# statistic recipient 
echo "Part one : - Top 10 Recipient domain " 
fgrep to= $RAN/maillog | cut -d\< -f2 | cut -d\> -f1 | \
cut -d@ -f2 | sort | uniq -c | sort -nr |head 
echo "" 
echo "" 

# statistic sender 
echo "Part two: - Top 10 Sender domain " 
fgrep from= $RAN/maillog | cut -d\< -f2 | cut -d\> -f1 | \ 
cut -d@ -f2 | sort | uniq -c | sort -nr | head 
echo "" 
echo "" 

# statistic destination mail total count 
echo "Part three: Total lines and sizes of log, And total mail sent" 
echo "Log_lines = `cat $RAN/maillog | wc -l | awk '{ print $1 }'`" 
echo "Log_sizes = `du -s $RAN/maillog | awk '{ print $1}'`" 
echo "Mail_sent = `cat $RAN/maillog | fgrep status=sent | wc -l | \ 
awk '{ print $1 }'`" 
rm -rf $RAN