Nabble - RRDTool - Mailgraph

dnsgraph problem

2009-11-27T01:38:55Z

# From: "Oliver Gros" <Oliver{dot}Gros{at}oatsystems{dot}com>
# Date: Mon, 23 Apr 2007 09:50:47 -0400

Are there still people interested in a solution for the problems described
in this thread posted in 2007?
(http://lists.ee.ethz.ch/mailgraph/msg00282.html )

I have looked into the problem and have a solution. I am also trying to
take over the abandoned project on SourceForge, but that takes 90 days
when the current developer of DNSGraph doesn't react to the mail
SourgeForge sent him...

The subject seems off topic on this list, therefore my question.

This weekend I will also post my solution on the bug tracker page of de
sourceforge-project, so one could also take a look over there:
https://sourceforge.net/tracker/?group_id=93706&atid=605266

--
Greetings,
Eric de Hont

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: postfix + clamav-milter

2009-09-18T03:50:19Z

Florian Erfurth schrieb:
> David Schweikert schrieb:
>
>> Can't you configure clamav-milter to write something to syslog?
>>
>
> Yes I think its possible. I have to look into configure-files and try
> it. I'll do that today evening when I'm home.
> I thought, mailgraph is only "looking" into mail.log.

Ok, I enabled clamav-milter to write syslog. The perl-script mailgraph
still need 1 modification in order to get clamav-milter working. In
mailgraph if $prog=="clamav-milter", then it look after "Intercepted",
but there is no "Intercepted" but "infected" from clamav-milter log.
But ok, I can live with this.

> By the way...
> every sent mail counts 1x sent (which is ok) and 1x received (today I
> sent to 3 recipients: 3x sent & 1x received. why???).
>

Resolved. I enabled "ignore-localhost" now it look good. Only 1 thing
goes wrong:
If clamav-milter tells postfix to reject this mail (because of virus),
mailgraph get count for virus *and* received. This is wrong because
postfix didn't received but rejected this mail. Why?

cu Floh

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: postfix + clamav-milter

2009-09-17T07:09:10Z

David Schweikert schrieb:
> On Thu, Sep 17, 2009 at 10:21:59 +0200, Florian Erfurth wrote:
>
>> I looked into perl script and found "clamav-milter" but in perl it
>> checks if $prog=="clamav-milter" actually (if you look my pasted log)
>> $prog == "cleanup".
>>
>
> Can't you configure clamav-milter to write something to syslog?
>
Yes I think its possible. I have to look into configure-files and try
it. I'll do that today evening when I'm home.
I thought, mailgraph is only "looking" into mail.log. By the way...
every sent mail counts 1x sent (which is ok) and 1x received (today I
sent to 3 recipients: 3x sent & 1x received. why???).

Thanx!
Floh

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: postfix + clamav-milter

2009-09-17T05:54:31Z

On Thu, Sep 17, 2009 at 10:21:59 +0200, Florian Erfurth wrote:
> I looked into perl script and found "clamav-milter" but in perl it
> checks if $prog=="clamav-milter" actually (if you look my pasted log)
> $prog == "cleanup".

Can't you configure clamav-milter to write something to syslog?

Cheers
David

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

postfix + clamav-milter

2009-09-17T01:21:59Z

Hi,
I'm using postfix and clamav-milter on debian lenny. Unfortunatelly
virus count is not working. I read the changelog, that clamav-milter is
supported since 1.09. I'm using 1.14. Probably the clamav-milter only
works with sendmail, right? In mail-log there is following log:

Sep 16 21:54:37 server postfix/smtpd[6899]: connect from
web.heise.de[193.99.144.71]
Sep 16 21:54:37 server postfix/smtpd[6899]: EB07C23F41:
client=web.heise.de[193.99.144.71]
Sep 16 21:54:38 server postfix/cleanup[6903]: EB07C23F41:
message-id=<E1Mo0aK-0000Yv-Ss.octo09@...>
Sep 16 21:54:38 server postfix/cleanup[6903]: EB07C23F41: milter-reject:
END-OF-MESSAGE from web.heise.de[193.99.144.71]: 5.7.1 This eMail is
infected by "Eicar-Test-Signature"; from=<emailcheck-robot@...>
to=<floh@...> proto=ESMTP helo=<web.heise.de>
Sep 16 21:54:38 server postfix/smtpd[6899]: disconnect from
web.heise.de[193.99.144.71]

I looked into perl script and found "clamav-milter" but in perl it
checks if $prog=="clamav-milter" actually (if you look my pasted log)
$prog == "cleanup". So I found in perlscript, where $prog == "cleanup".
I added some lines there:

--- mailgraph 2009-09-17 10:01:26.000000000 +0200
+++ mailgraph-modified 2009-09-17 09:58:22.000000000 +0200
@@ -628,7 +628,12 @@
}
}
elsif($prog eq 'cleanup') {
- if($text =~ /^[0-9A-Z]+: (?:reject|discard): /) {
+ if($text =~ /^(?:[0-9A-Z]+: )?milter-reject: /) {
+ if($text =~ /infected/) {
+ event($time, 'virus');
+ }
+ }
+ elsif($text =~ /^[0-9A-Z]+: (?:reject|discard): /) {
event($time, 'rejected');
}
}

Now it works fine. But the following message is written by me in
(/etc/clamav/clamav-milter.log in ) so this text is user-defined, so
if($text =~ /infected/) only works if the custom log-text actually
contains this word:
This eMail is infected by "Eicar-Test-Signature"

1. What is the best way to parse this virus report in mail.log to get
virus-count working? Probably the custom-text must have some (generic)
keywords, maybe like "milter-virusscan". I said generic since I don't
want to "reply"(reject) virus-sender with information which virusscanner
I'm using.
2. @devs: Could you fix mailgraph perlscript, so it works fine with
clamav-milter+postfix in next version?

If you need more information, let me know please and I'll provide this.
And... no... I don't know much about perl-programming. ( it was just my
luck *cough* ;) )

cu Floh

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Rewrite mailgraph with fastcgi

2009-08-28T02:05:26Z

Hi, i rewrite mailgraph 1.14 with support fastcgi protocol

use FCGI и FCGI::ProcManager modules

it's configured for
1. /graph/ uri
2. 127.0.0.1:10000 socket for backend(i'm using nginx)
3. /var/run/mailgraph/mailgraph-fcgi.pid pid for rc script (i'm using
freebsd rc script)

nginx config:

location /graph {
fastcgi_pass 127.0.0.1:10000;
include fastcgi.conf;
}

freebsd rc script:

#!/bin/sh
#
#
# PROVIDE: mailgraphfcgi
# REQUIRE: DAEMON
#
#
# mailgraphfcgi_enable="YES"
#

. /etc/rc.subr

name="mailgraphfcgi"
rcvar=`set_rcvar`

command=/usr/local/www/cgi-bin/mailgraph.fcgi
procname=perl-fcgi-pm
#command_interpreter=/usr/bin/perl
pidfile=/var/run/mailgraph/mailgraph-fcgi.pid
stop_postcmd=stop_postcmd

stop_postcmd()
{
rm -f $pidfile
}

load_rc_config $name

: ${mailgraphfcgi_enable="NO"}

run_rc_command "$1"

examples look at http://mail.vyborg.ru/graph

Here is diff:
--- mailgraph.cgi 2008-09-16 14:24:57.000000000 +0400
+++ mailgraph.fcgi 2009-08-28 12:49:55.000000000 +0400
@@ -1,17 +1,23 @@
#!/usr/bin/perl -w
-
# mailgraph -- postfix mail traffic statistics
# copyright (c) 2000-2007 ETH Zurich
# copyright (c) 2000-2007 David Schweikert <david@...>
# released under the GNU General Public License

+use strict;
+use warnings;
+
+use FCGI;
+use POSIX;
+use FCGI::ProcManager qw(pm_manage pm_pre_dispatch pm_post_dispatch
pm_write_pid_file); +
use RRDs;
use POSIX qw(uname);

my $VERSION = "1.14";

my $host = (POSIX::uname())[1];
-my $scriptname = 'mailgraph.cgi';
+my $scriptname = '/graph/';
my $xpoints = 540;
my $points_per_sample = 3;
my $ypoints = 160;
@@ -19,6 +25,16 @@
my $rrd = '/var/db/mailgraph/mailgraph.rrd'; # path to where the RRD
database is my $rrd_virus = '/var/db/mailgraph/mailgraph_virus.rrd'; #
path to where the Virus RRD database is my $tmp_dir = '/tmp/mailgraph';
# temporary directory where to store the images +my $pid_file =
'/var/run/mailgraph/mailgraph-fcgi.pid'; +my $bind_host =
'127.0.0.1:10000'; +
+
+sub reopen_std {
+ open(STDIN, "+>/dev/null") or die "Can't open STDIN: $!";
+ open(STDOUT, "+>&STDIN") or die "Can't open STDOUT: $!";
+ open(STDERR, "+>&STDIN") or die "Can't open STDERR: $!";
+};
+
my @graphs = (
{ title => 'Last Day', seconds => 3600*24, },
@@ -163,7 +179,7 @@
<title>Mail statistics for $host</title>
<meta http-equiv="Refresh" content="300" />
<meta http-equiv="Pragma" content="no-cache" />
-<link rel="stylesheet" href="/mailgraph/mailgraph.css"
type="text/css" /> +<link rel="stylesheet" href="mailgraph.css"
type="text/css" /> </head>
<body>
HEADER
@@ -241,4 +257,44 @@
}
}

-main;
+
+
+
+
+sub fork_proc {
+ my $pid;
+
+ FORK: {
+ if (defined($pid = fork)) {
+ return $pid;
+ }
+ elsif ($! =~ /No more process/) {
+ sleep 5;
+ redo FORK;
+ }
+ else {
+ die "Can't fork: $!";
+ };
+ };
+};
+
+
+fork_proc() && exit 0;
+POSIX::setsid() or die "Can't set sid: $!";
+chdir '/' or die "Can't chdir: $!";
+POSIX::setuid(80) or die "Can't set uid: $!";
+my $socket = FCGI::OpenSocket($bind_host, 5);
+my $request = FCGI::Request(\*STDIN, \*STDOUT, \*STDERR, \%ENV,
$socket, FCGI::FAIL_ACCEPT_ON_INTR); +
+pm_write_pid_file($pid_file);
+pm_manage(n_processes => 2);
+reopen_std();
+
+my $count = 1;
+
+while($request->Accept() >= 0) {
+ pm_pre_dispatch();
+ main();
+ pm_post_dispatch();
+};
+

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: mailgraph do not count received and rejects

2009-01-22T14:25:29Z

Hi all,

>>> I have a problem. Mailgraph do not count rejects and received.
>>>
>>> Mailgraph 1.14
>>> Postfix 2.3

I changed Postfix to 2.5 but it doesn't help.... any ideas are welcome ;)

Regards

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: mailgraph do not count received and rejects

2009-01-06T01:07:25Z

Hi,

>> I have a problem. Mailgraph do not count rejects and received.
>>
>> Mailgraph 1.14
>> Postfix 2.3

HvdK> Can you share a set of log lines for say 3 to 5 messages?

HvdK> Make sure they get to the list as verbatim as you found them in the log
HvdK> file.

Here "reject's":

Jan 4 20:01:47 smeagol postfix/smtpd[7688]: NOQUEUE: reject: RCPT from unknown[58.33.176.54]: 554 5.7.1 <unknown[58.33.176.54]>: Client host rejected: Access denied; f
rom=<received92@...> to=<abrahamdonohue@...> proto=ESMTP helo=<54.176.33.58.broad.xw.sh.dynamic.163data.com.cn>
Jan 4 20:01:48 smeagol postfix/smtpd[7688]: NOQUEUE: reject: RCPT from unknown[58.33.176.54]: 554 5.7.1 <unknown[58.33.176.54]>: Client host rejected: Access denied; f
rom=<received92@...> to=<abrahamdonohue@...> proto=ESMTP helo=<54.176.33.58.broad.xw.sh.dynamic.163data.com.cn>

Here "received"
Jan 4 20:17:04 smeagol postfix/smtpd[14063]: connect from unknown[194.59.169.11]
Jan 4 21:17:05 smeagol postgrey[26403]: action=pass, reason=triplet found, client_name=unknown, client_address=194.59.169.11, sender=info@..., recipient=lj@
fto.de
Jan 4 21:17:05 smeagol postfix/smtpd[21089]: connect from unknown[127.0.0.1]
Jan 4 20:17:05 smeagol postfix/smtpd[14063]: NOQUEUE: client=unknown[194.59.169.11]
Jan 4 20:17:05 smeagol postfix/smtpd[21089]: 7D06C82F08B: client=unknown[194.59.169.11]
Jan 4 21:17:05 smeagol before-remote[21088]: check handlers for addr: info@...
Jan 4 21:17:05 smeagol before-queue[21086]: check handlers for addr: info@...
Jan 4 21:17:05 smeagol before-queue[21086]: check handlers for addr:
xx@...
Jan 4 21:17:05 smeagol before-remote[21088]: check handlers for addr:
xx@...
Jan 4 21:17:05 smeagol before-remote[21088]: Processing handlers...
Jan 4 20:17:05 smeagol postfix/smtpd[8841]: connect from unknown[84.245.213.74]
Jan 4 21:17:05 smeagol before-remote[21088]: hook_dir = '/usr/local/psa/handlers/before-remote'
Jan 4 21:17:05 smeagol before-remote[21088]: recipient[3] = 'xx@...'
Jan 4 21:17:05 smeagol before-remote[21088]: handlers dir =
'/usr/local/psa/handlers/before-remote/recipient/xx@...'
Jan 4 21:17:05 smeagol postfix/cleanup[21091]: 7D06C82F08B: message-id=<783192757feb0386f1feb4fc39caeb47@...>
Jan 4 21:17:05 smeagol postfix/qmgr[29577]: 7D06C82F08B: from=<info@...>, size=12777, nrcpt=1 (queue active)
Jan 4 20:17:05 smeagol postfix/smtpd[14063]: disconnect from unknown[194.59.169.11]
Jan 4 20:17:05 smeagol postfix/smtpd[21089]: disconnect from unknown[127.0.0.1]

HvdK> Also indicate which counters do seem to work.

The counters that works are sent, bounced and spam(with spamd).

Regards,

Herbert

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: mailgraph do not count received and rejects

2009-01-04T22:57:07Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Carnac wrote:

> I have a problem. Mailgraph do not count rejects and received.
>
> Mailgraph 1.14
> Postfix 2.3

Can you share a set of log lines for say 3 to 5 messages?

Make sure they get to the list as verbatim as you found them in the log
file.

Also indicate which counters do seem to work.

Hugo.

- --
hvdkooij@... http://hugo.vanderkooij.org/
PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc

A: Yes.
>Q: Are you sure?
>>A: Because it reverses the logical flow of conversation.
>>>Q: Why is top posting frowned upon?

Bored? Click on http://spamornot.org/ and rate those images.

Nid wyf yn y swyddfa ar hyn o bryd. Anfonwch unrhyw waith i'w gyfieithu.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAklhr0EACgkQBvzDRVjxmYHADQCeOdnoD18+PDmnzpiUpGRG9Vgc
wmwAoK090MPJVyHUlzCLWYvrubUT+Seo
=PMiM
-----END PGP SIGNATURE-----

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

mailgraph do not count received and rejects

2009-01-04T15:20:10Z

hi,

I have a problem. Mailgraph do not count rejects and received.

Mailgraph 1.14
Postfix 2.3

I tried to debug the mailgraph (v1.14) a little bit.

First I look for parsing, it works and forwards to "sub events",
but there are no counts.

Example log
1. debug 1231090994: client: unknown[67.207.186.81]
-> parsing works and calls "event($time, 'received')"

2. debug received=0
-> $sum(received) before code line "update($t) and $sum{$type}++;"
in sub event()

3. debug 1231090994: received=0
-> sum(received) after "my $t = shift;" in sub update()

4. debug received2=0
-> $sum(received) after code line "update($t) and $sum{$type}++;"
in sub event()

Any hints ?

regards
Herbert

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: Virus and Quarantine Counts Contained in Separate Log - How Do IAdd Them?

2008-12-15T19:31:41Z

> I am sucessfully running mailgraph, wow it looks sweet! I've modified
the mailgraph.cgi and init scripts so that I can run one daemon for each
log file that I am parsing, a total of eight daemons for eight mail
servers. At some point I need to create a script to download the new
mail logfiles, and parse them, each of my eight mailservers right now
send their syslog data to a central host, which is where I am running
mailgraph from.
>
> Two issues:
>
> 1. I am still running into a problem whereby my hostnames are in the
HOSTNAME/HOSTNAME format, and mailgraph expects to see them in the
HOSTNAME format. Any help there would be greatly appreciated, my perl is
terrible.
>
> 2. My other problem is that in my setup, Postfix does not know when
an email has been quarantined or flagged as a virus.
Postfix hands off email to port 10022, whereby Trend VirusWall (actually
IMSS) takes over, eventually handing it back to another Postfix
listening on port 10023.

----------------

If you ever get a response to the second question, I'd be very
interested as well. We also use IMSS, and while I had a look at it some
time ago, I'm not a natural coder, and the time it'd take me to extract
the information and add it to the RRD graphs would be *days* (assuming I
actually succeed), which should probably be devoted to doing my actual
job.

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-13T04:37:52Z

-----BEGIN PGP SIGNED MESSAGE-----

> Hash: SHA1
>
> L x wrote:
>> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5:
>> client=unknown[10.8.100.147]
>> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5:
>> message-id=<20081212170635.21984.qmail@...>
>> Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5:
>> from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@...>,
>> size=4954, nrcpt=1 (queue active)
>> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: disconnect from
>> unknown[10.8.100.147]
>> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: connect from
>> localhost[127.0.0.1]
>> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: C938426EE8:
>> client=localhost[127.0.0.1]
>> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8:
>> message-id=<20081212170635.21984.qmail@...>
>
> I would say it is clearly an issue of passing the same message twice
> through postfix. Something that happens if you use something like amavis
> or a similar construct.

yes i knew

> So you need to ignore the log entries by the localhost as advertised.
already done.
> Given your responses I feel you are not very well familiar with how your
> system works. It would be good to study it's working in detail.
problem solved by removing DSPAM and reconfiguring postfix (:

Thanks all !

> Hugo.
>
> - --
> hvdkooij@... http://hugo.vanderkooij.org/
> PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc
>
> A: Yes.
> >Q: Are you sure?
> >>A: Because it reverses the logical flow of conversation.
> >>>Q: Why is top posting frowned upon?
>
> Bored? Click on http://spamornot.org/ and rate those images.
>
> Nid wyf yn y swyddfa ar hyn o bryd. Anfonwch unrhyw waith i'w gyfieithu.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFJQ3DNBvzDRVjxmYERAneIAJsFbOycsrQwfzihXjkbr7Ry0PfycACfYdBB
> B5FLv2MQGSLPsz9R+DgAvXo=
> =4aR0
> -----END PGP SIGNATURE-----
>
> --
> Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
> Help mailto:mailgraph-request@...?subject=help
> Archive http://lists.ee.ethz.ch/mailgraph
> WebAdmin http://lists.ee.ethz.ch/lsg2.cgi
>
>

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-13T00:22:40Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

L x wrote:

> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5:
> client=unknown[10.8.100.147]
> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5:
> message-id=<20081212170635.21984.qmail@...>
> Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5:
> from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@...>,
> size=4954, nrcpt=1 (queue active)
> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: disconnect from
> unknown[10.8.100.147]
> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: connect from
> localhost[127.0.0.1]
> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: C938426EE8:
> client=localhost[127.0.0.1]
> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8:
> message-id=<20081212170635.21984.qmail@...>

I would say it is clearly an issue of passing the same message twice
through postfix. Something that happens if you use something like amavis
or a similar construct.

So you need to ignore the log entries by the localhost as advertised.

Given your responses I feel you are not very well familiar with how your
system works. It would be good to study it's working in detail.

Hugo.

- --
hvdkooij@... http://hugo.vanderkooij.org/
PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc

A: Yes.
>Q: Are you sure?
>>A: Because it reverses the logical flow of conversation.
>>>Q: Why is top posting frowned upon?

Bored? Click on http://spamornot.org/ and rate those images.

Nid wyf yn y swyddfa ar hyn o bryd. Anfonwch unrhyw waith i'w gyfieithu.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFJQ3DNBvzDRVjxmYERAneIAJsFbOycsrQwfzihXjkbr7Ry0PfycACfYdBB
B5FLv2MQGSLPsz9R+DgAvXo=
=4aR0
-----END PGP SIGNATURE-----

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-12T09:48:45Z

> On Fri, Dec 12, 2008 at 06:21:24PM +0100, L x wrote:
>>
>> ----- Original Message -----
>> From: "Petar Bogdanovic" <petar@...>
>> To: <mailgraph@...>
>> Sent: Friday, December 12, 2008 6:00 PM
>> Subject: [mailgraph] Re: A litlle problem !
>>
>>
>> >
>> > On Fri, Dec 12, 2008 at 05:54:18PM +0100, L x wrote:
>> >> (...)
>> >> When i recieve a new mail on postfi, mailgraph count it as 2 new mail
>> >> !!! and not one ... where can the problem come from ??
>> >
>> > The pattern for one received message is 'postfix/smtpd.*client='. How
>> > do
>> > the logs look like? Maybe some daemon is resubmitting the message?
>>
>>
>> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5:
>> client=unknown[10.8.100.147]
>> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5:
>> message-id=<20081212170635.21984.qmail@...>
>> Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5:
>> from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@...>,
>> size=4954, nrcpt=1 (queue active)
>> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: disconnect from
>> unknown[10.8.100.147] Dec 12 18:13:25 spamdmail postfix/smtpd[3187]:
>> connect from localhost[127.0.0.1]
>> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: C938426EE8:
>> client=localhost[127.0.0.1]
>> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8:
>> message-id=<20081212170635.21984.qmail@...>
>
> 543E226EE5 and C938426EE8 have the same message-id so postfix does
> resubmit the message (see client=localhost[127.0.0.1])..
>
> Whats the recipient address and is it maybe an alias?

admins@... and its not an alias ... for you concern we have
a frontened spamdb greylist server.. its not on the same server, so i dont
think this as anything to do to with my problem !
Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8: message-id= so
this must be this "cleanup" dont know what this is ...

>
> --
> Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
> Help mailto:mailgraph-request@...?subject=help
> Archive http://lists.ee.ethz.ch/mailgraph
> WebAdmin http://lists.ee.ethz.ch/lsg2.cgi
>
>

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-12T09:42:00Z

On Fri, Dec 12, 2008 at 06:32:54PM +0100, Petar Bogdanovic wrote:

> On Fri, Dec 12, 2008 at 06:21:24PM +0100, L x wrote:
> >
> > ----- Original Message -----
> > From: "Petar Bogdanovic" <petar@...>
> > To: <mailgraph@...>
> > Sent: Friday, December 12, 2008 6:00 PM
> > Subject: [mailgraph] Re: A litlle problem !
> >
> >
> > >
> > > On Fri, Dec 12, 2008 at 05:54:18PM +0100, L x wrote:
> > >> (...)
> > >> When i recieve a new mail on postfi, mailgraph count it as 2 new mail
> > >> !!! and not one ... where can the problem come from ??
> > >
> > > The pattern for one received message is 'postfix/smtpd.*client='. How do
> > > the logs look like? Maybe some daemon is resubmitting the message?
> >
> >
> > Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5: client=unknown[10.8.100.147]
> > Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5: message-id=<20081212170635.21984.qmail@...>
> > Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5: from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@...>, size=4954, nrcpt=1 (queue active)
> > Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: disconnect from unknown[10.8.100.147]
> > Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: connect from localhost[127.0.0.1]
> > Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: C938426EE8: client=localhost[127.0.0.1]
> > Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8: message-id=<20081212170635.21984.qmail@...>
>
> 543E226EE5 and C938426EE8 have the same message-id so postfix does
> resubmit the message (see client=localhost[127.0.0.1])..
>
> Whats the recipient address and is it maybe an alias?

No, sorry. postfix does not resubmit. Some other daemon does.

It would be interesting to know what happens after qmgr. How does your
main.cf look like? (please don't paste it -- attach it instead)

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-12T09:32:54Z

On Fri, Dec 12, 2008 at 06:21:24PM +0100, L x wrote:

>
> ----- Original Message -----
> From: "Petar Bogdanovic" <petar@...>
> To: <mailgraph@...>
> Sent: Friday, December 12, 2008 6:00 PM
> Subject: [mailgraph] Re: A litlle problem !
>
>
> >
> > On Fri, Dec 12, 2008 at 05:54:18PM +0100, L x wrote:
> >> (...)
> >> When i recieve a new mail on postfi, mailgraph count it as 2 new mail
> >> !!! and not one ... where can the problem come from ??
> >
> > The pattern for one received message is 'postfix/smtpd.*client='. How do
> > the logs look like? Maybe some daemon is resubmitting the message?
>
>
> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5: client=unknown[10.8.100.147]
> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5: message-id=<20081212170635.21984.qmail@...>
> Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5: from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@...>, size=4954, nrcpt=1 (queue active)
> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: disconnect from unknown[10.8.100.147] Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: connect from localhost[127.0.0.1]
> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: C938426EE8: client=localhost[127.0.0.1]
> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8: message-id=<20081212170635.21984.qmail@...>

543E226EE5 and C938426EE8 have the same message-id so postfix does
resubmit the message (see client=localhost[127.0.0.1])..

Whats the recipient address and is it maybe an alias?

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-12T09:32:51Z

yes, i dit it when in made the dpkg-reconfigure mailgraph

(:
must come from one of the deamon installed .. i just uninstalled DSPAM ...
and nothing is coming in or getting out anymore ^^

----- Original Message -----
From: "Sampson, Warren" <WSampson@...>
To: "L x" <hellix@...>
Cc: <mailgraph@...>
Sent: Friday, December 12, 2008 6:27 PM
Subject: RE: [mailgraph] Re: A litlle problem !

-----Original Message-----
From: mailgraph-bounce@...
[mailto:mailgraph-bounce@...] On Behalf Of L x
Sent: December 12, 2008 12:21 PM
To: mailgraph@...
Subject: [mailgraph] Re: A litlle problem !
>
> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5:
> client=unknown[10.8.100.147]
> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5:
> message-id=<20081212170635.21984.qmail@...>
> Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5:
>
from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@mi
cromania.fr>,

> size=4954, nrcpt=1 (queue active)
> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: disconnect from
> unknown[10.8.100.147]
> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: connect from
> localhost[127.0.0.1]
> Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: C938426EE8:
> client=localhost[127.0.0.1]
> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8:
> message-id=<20081212170635.21984.qmail@...>
>
> yeah maybe there's something that bugs everything
> this is the log
>

Have you specified mailgraph to ignore the local host (127.0.0.1)?

--ignore-localhost

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-12T09:27:24Z

-----Original Message-----
From: mailgraph-bounce@...
[mailto:mailgraph-bounce@...] On Behalf Of L x
Sent: December 12, 2008 12:21 PM
To: mailgraph@...
Subject: [mailgraph] Re: A litlle problem !
>
> Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5:
> client=unknown[10.8.100.147]
> Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5:
> message-id=<20081212170635.21984.qmail@...>
> Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5:
>
from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@mi
cromania.fr>,

Re: A litlle problem !

2008-12-12T09:21:24Z

Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: 543E226EE5:
client=unknown[10.8.100.147]
Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: 543E226EE5:
message-id=<20081212170635.21984.qmail@...>
Dec 12 18:13:25 spamdmail postfix/qmgr[2284]: 543E226EE5:
from=<mailing-micromania-return-1-emeric.grandsart=cyberchatmania.org@...>,
size=4954, nrcpt=1 (queue active)
Dec 12 18:13:25 spamdmail postfix/smtpd[3181]: disconnect from
unknown[10.8.100.147]
Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: connect from
localhost[127.0.0.1]
Dec 12 18:13:25 spamdmail postfix/smtpd[3187]: C938426EE8:
client=localhost[127.0.0.1]
Dec 12 18:13:25 spamdmail postfix/cleanup[3184]: C938426EE8:
message-id=<20081212170635.21984.qmail@...>

yeah maybe there's something that bugs everything
this is the log

----- Original Message -----
From: "Petar Bogdanovic" <petar@...>
To: <mailgraph@...>
Sent: Friday, December 12, 2008 6:00 PM
Subject: [mailgraph] Re: A litlle problem !

>
> On Fri, Dec 12, 2008 at 05:54:18PM +0100, L x wrote:
>> (...)
>> When i recieve a new mail on postfi, mailgraph count it as 2 new mail
>> !!! and not one ... where can the problem come from ??
>
> The pattern for one received message is 'postfix/smtpd.*client='. How do
> the logs look like? Maybe some daemon is resubmitting the message?
>
> --
> Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
> Help mailto:mailgraph-request@...?subject=help
> Archive http://lists.ee.ethz.ch/mailgraph
> WebAdmin http://lists.ee.ethz.ch/lsg2.cgi
>
>

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: A litlle problem !

2008-12-12T09:00:33Z

On Fri, Dec 12, 2008 at 05:54:18PM +0100, L x wrote:
> (...)
> When i recieve a new mail on postfi, mailgraph count it as 2 new mail
> !!! and not one ... where can the problem come from ??

The pattern for one received message is 'postfix/smtpd.*client='. How do
the logs look like? Maybe some daemon is resubmitting the message?

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

A litlle problem !

2008-12-12T08:54:17Z

Ok, thank you very much for you script, very useful !
I've installed it without problem, and i've got my graphs printed very well ... expect one little problem ...
When i recieve a new mail on postfi, mailgraph count it as 2 new mail !!! and not one ... where can the problem come from ??
i reconfigure the package with dpkg-reconfigure but it doesnt change anything !!!
any ideas ??

Thanks,

Phil from paris !
--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

postfix received message pattern

2008-09-28T14:41:05Z

Hi,

in mailgraph a received (postfix) message is represented by the
following simplified pattern:

smtpd.*client=.*

Unfortunately this also matches the following scenario, where a milter rejects
a message based on its body:

postfix/smtpd[20004]: connect from abwx191.neoplus.adsl.tpnet.pl[83.8.247.191]
postfix/smtpd[20004]: 899E41A439: client=abwx191.neoplus.adsl.tpnet.pl[83.8.247.191]
postfix/cleanup[19855]: 899E41A439: message-id=<C815E8E2.8F9DF740@...>
postfix/cleanup[19855]: 899E41A439: milter-reject: END-OF-MESSAGE from (...): 5.7.1 Mail rejected: Access denied; (...) proto=SMTP helo=<fastmail.fm>

Of course one could say that the message was actually received if a body
check is possible but I still think that a received message is not
received until the mailserver accepts it with reply code 200-something..

So, bug or feature?

Thanks,

Petar

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: Virus and Quarantine Counts Contained in Separate Log - How Do I Add Them?

2008-09-11T12:20:43Z

Thank you Ralf, that is an excellent idea, just not sure how I could make it work.

I suppose this might work:

mailgraph.pl -l `sed 's/mailserver.example.com\/mailserver.example.com/mailserver.example.com/' /var/log/maillog` -d --daemon-pid=$PID_FILE --daemon-rrd=$RRD_DIR

Has anyone tried it? Otherwise, I'll try tomorrow and let you all know.

What I would like to do is simply modify, assuming that is all I need to modify, the following line to double the hostname entry:

\s
([-\w\.\@:]+) # host -- 6
\s+

Thanks again,

.vp

> Date: Thu, 11 Sep 2008 20:45:17 +0200
> From: Ralf.Hildebrandt@...
> To: mailgraph@...
> Subject: [mailgraph] Re: Virus and Quarantine Counts Contained in Separate Log - How Do I Add Them?
>
> * wiskbroom@... <wiskbroom@...>:
> > All;
> >
> > First, does anyone read email from this list? I ask because this is
> > now my fourth posting in a row, all of which I've never received a
> > reply for :-(
>
> I do.
>
> > Just in case, here goes:
> >
> > I am sucessfully running mailgraph, wow it looks sweet! I've modified
> > the mailgraph.cgi and init scripts so that I can run one daemon for
> > each log file that I am parsing, a total of eight daemons for eight
> > mail servers. At some point I need to create a script to download the
> > new mail logfiles, and parse them, each of my eight mailservers right
> > now send their syslog data to a central host, which is where I am
> > running mailgraph from.
> >
> > Two issues:
> >
> > 1. I am still running into a problem whereby my hostnames are in the
> > HOSTNAME/HOSTNAME format, and mailgraph expects to see them in the
> > HOSTNAME format. Any help there would be greatly appreciated, my perl
> > is terrible.
>
> You could pipe them through sed to replace HOSTNAME/HOSTNAME with just
> HOSTNAME!
>
> --
> Ralf Hildebrandt (i.A. des IT-Zentrums) Ralf.Hildebrandt@...
> Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
> Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
> IT-Zentrum Standort CBF I'm looking for a job!

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: Virus and Quarantine Counts Contained in Separate Log - How Do I Add Them?

2008-09-11T11:45:17Z

* wiskbroom@... <wiskbroom@...>:
> All;
>
> First, does anyone read email from this list? I ask because this is
> now my fourth posting in a row, all of which I've never received a
> reply for :-(

I do.

> Just in case, here goes:
>
> I am sucessfully running mailgraph, wow it looks sweet! I've modified
> the mailgraph.cgi and init scripts so that I can run one daemon for
> each log file that I am parsing, a total of eight daemons for eight
> mail servers. At some point I need to create a script to download the
> new mail logfiles, and parse them, each of my eight mailservers right
> now send their syslog data to a central host, which is where I am
> running mailgraph from.
>
> Two issues:
>
> 1. I am still running into a problem whereby my hostnames are in the
> HOSTNAME/HOSTNAME format, and mailgraph expects to see them in the
> HOSTNAME format. Any help there would be greatly appreciated, my perl
> is terrible.

You could pipe them through sed to replace HOSTNAME/HOSTNAME with just
HOSTNAME!

--
Ralf Hildebrandt (i.A. des IT-Zentrums) Ralf.Hildebrandt@...
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
IT-Zentrum Standort CBF I'm looking for a job!

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Virus and Quarantine Counts Contained in Separate Log - How Do I Add Them?

2008-09-11T10:34:00Z

All;

First, does anyone read email from this list? I ask because this is now my fourth posting in a row, all of which I've never received a reply for :-(

Just in case, here goes:

I am sucessfully running mailgraph, wow it looks sweet! I've modified the mailgraph.cgi and init scripts so that I can run one daemon for each log file that I am parsing, a total of eight daemons for eight mail servers. At some point I need to create a script to download the new mail logfiles, and parse them, each of my eight mailservers right now send their syslog data to a central host, which is where I am running mailgraph from.

Two issues:

1. I am still running into a problem whereby my hostnames are in the HOSTNAME/HOSTNAME format, and mailgraph expects to see them in the HOSTNAME format. Any help there would be greatly appreciated, my perl is terrible.

2. My other problem is that in my setup, Postfix does not know when an email has been quarantined or flagged as a virus.
Postfix hands off email to port 10022, whereby Trend VirusWall (actually IMSS) takes over, eventually handing it back to another Postfix listening on port 10023. In order to accurately report the total of quaratined emails and total number of viruses for a given day, I would have to somehow inject the results of a script which look like the following:

20080903 10 4 14

Looking at the results above, the first field would be the date in YYYYMMDD format.

The second field would be the total number of quarantined email for the date in the first field.

The third field would be the total number of viruses found for email for the date in the first field.

The fourth and last field would be the total of the sums contained for fields two and three.

(It would be difficult, and not worth my time, to add their times)

How, if at all possible, can I inject this data into my RRD graphs for virus and quarantine info?

Many thanks to all in advance,

.Vadim

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Need To Run Mailgraph Once Per Day - Not in Daemon Mode

2008-09-08T10:35:28Z

All;

While I am trying to solve my syslog-ng woes, I am trying to determine a way whereby I could copy my maillogs once per day from a host, then using that log, build my html output rather than using the cgi-script to build dynamically.

Two reasons why I would like to do this:

1. I have four seperate mail-servers, and would like to have seperate graphs for each.
2. The cgi-script takes a long time to run, and having it automatically created once or twice per day should suffice.

Thank you,

.vp

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: Need Help With RRD Perl Module Installation/Use

2008-09-08T06:17:44Z

All;

I realize that this is a low-noise list, which I appreciate, but is anyone else on it :-)

In searching the archives further, I've found a patch made by Mark Loeser on 27 JUNE 2005 (For syslog-ng Gentoo) affecting the following lines in mailgraph.pl:

http://lists.ee.ethz.ch/mailgraph/msg00122.html

In reviewing his patch, I've noticed that it is slightly different from today's version, perhaps due to further changes in the past three years? but felt it might shed some light on my problem.

Here is the
Here is the snippet of code that contains my problem (I am horrible at PCRE and REGEX, otherwise I'd just post my own patch) :

sub _next_syslog($)
{
my ($self) = @_;
while($self->{_repeat}>0) {
$self->{_repeat}--;
return $self->{_repeat_data};
}

my $file = $self->{file};
line: while(defined (my $str = $self->_next_line)) {
# date, time and host
$str =~ /^
(\S{3})\s+(\d+) # date -- 1, 2
\s
(\d+):(\d+):(\d+) # time -- 3, 4, 5
(?:\s)? # FreeBSD's verbose-mode
\s
([-\w\.\@:]+) # host -- 6
\s+
(?:\[LOG_[A-Z]+\]\s+)? # FreeBSD
(.*) # text -- 7
$/x or do
{
warn "WARNING: line not in syslog format: $str";
next line;
};

> From: wiskbroom@...
> To: mailgraph@...
> Subject: [mailgraph] Re: Need Help With RRD Perl Module Installation/Use
> Date: Fri, 5 Sep 2008 16:37:33 -0400
>
> Reading a posting in the archives replied to by , I see that I should have added the following line to mailgraph.cgi and mailgraph.pl
>
> I am not seeing any input into my database, so I ran strace and saw:
>
> write(2, "WARNING: line not in syslog form"..., 209) = 209
> write(2, "WARNING: line not in syslog form"..., 167) = 167
> write(2, "WARNING: line not in syslog form"..., 172) = 172
> write(2, "WARNING: line not in syslog form"..., 173) = 173
> write(2, "WARNING: line not in syslog form"..., 194) = 194
> write(2, "WARNING: line not in syslog form"..., 172) = 172
>
> My logs look like:
>
> Sep 5 16:31:45 mailserver.example.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 597816CB1E: from=, size=14602, nrcpt=1 (queue active)
>
> Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 3081A6CB1C: removed
>
> Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 1C0426CB1D: removed
>
> Is there an option or way to handle this? I am using syslog-ng, latest, and am purposely stuffing my data into files named after the host, into a directory named after the same.
>
> Thanks all,
>
> .vp
>
>> From: wiskbroom@...
>> To: mailgraph@...
>> Subject: [mailgraph] Need Help With RRD Perl Module Installation/Use
>> Date: Fri, 5 Sep 2008 15:09:09 -0400
>>
>> Hello;
>>
>> I am very new to this list. I've just installed RRDtool for the purpose of using it within the mailgraph perl script.
>>
>> When I try to run the script, I get:
>>
>> -bash-3.00# ./mailgraph.pl
>>
>> Can't load '/usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi/auto/RRDs/RRDs.so' for module RRDs: librrd.so.4: cannot open shared object file: No such file or directory at /usr/lib/perl5/5.8.6/i386-linux-thread-multi/DynaLoader.pm line 230. at ./mailgraph.pl line 360
>> Compilation failed in require at ./mailgraph.pl line 360.
>> BEGIN failed--compilation aborted at ./mailgraph.pl line 360.
>>
>> -bash-3.00#
>>
>> I tried to install the perl mods by:
>>
>>
>> cd /src/rrdtool-1.3.1/bindings/perl-shared
>> perl Makefile.PL
>> make
>> make test < -- This yielded one error - See below
>>
>>
>> -bash-3.00# make test
>>
>> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
>> t/base......Can't load '/usr/local/src/rrdtool-1.3.1/bindings/perl-shared/blib/arch/auto/RRDs/RRDs.so' for module RRDs: librrd.so.4: cannot open shared object file: No such file or directory at /usr/lib/perl5/5.8.6/i386-linux-thread-multi/DynaLoader.pm line 230.
>> at t/base.t line 20
>> Compilation failed in require at t/base.t line 20.
>> BEGIN failed--compilation aborted at t/base.t line 20.
>> t/base...... Dubious, test returned 255 (wstat 65280, 0xff00)
>> Failed 7/7 subtests
>>
>> Test Summary Report
>> -------------------
>> t/base.t (Wstat: 65280 Tests: 1 Failed: 1)
>> Failed test: 1
>> Non-zero exit status: 255
>> Parse errors: Bad plan. You planned 7 tests but ran 1.
>> Files=1, Tests=1, 0 wallclock secs ( 0.01 usr 0.00 sys + 0.02 cusr 0.01 csys = 0.04 CPU)
>> Result: FAIL
>> Failed 1/1 test programs. 1/1 subtests failed.
>> make: *** [test_dynamic] Error 255
>>
>> I am running an i386 on FC.
>>
>> Many thanks in advance!
>>
>> .vp
>>

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: Need Help With RRD Perl Module Installation/Use

2008-09-05T13:37:33Z

Reading a posting in the archives replied to by , I see that I should have added the following line to mailgraph.cgi and mailgraph.pl

I am not seeing any input into my database, so I ran strace and saw:

write(2, "WARNING: line not in syslog form"..., 209) = 209
write(2, "WARNING: line not in syslog form"..., 167) = 167
write(2, "WARNING: line not in syslog form"..., 172) = 172
write(2, "WARNING: line not in syslog form"..., 173) = 173
write(2, "WARNING: line not in syslog form"..., 194) = 194
write(2, "WARNING: line not in syslog form"..., 172) = 172

My logs look like:

Sep 5 16:31:45 mailserver.example.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 597816CB1E: from=<203176.549962556@...>, size=14602, nrcpt=1 (queue active)

Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 3081A6CB1C: removed

Sep 5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 1C0426CB1D: removed

Is there an option or way to handle this? I am using syslog-ng, latest, and am puirposely stuffing my data into files named after the host, into a directory named after the same.

Thanks all,

.vp

> From: wiskbroom@...
> To: mailgraph@...
> Subject: [mailgraph] Need Help With RRD Perl Module Installation/Use
> Date: Fri, 5 Sep 2008 15:09:09 -0400
>
> Hello;
>
> I am very new to this list. I've just installed RRDtool for the purpose of using it within the mailgraph perl script.
>
> When I try to run the script, I get:
>
> -bash-3.00# ./mailgraph.pl
>
> Can't load '/usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi/auto/RRDs/RRDs.so' for module RRDs: librrd.so.4: cannot open shared object file: No such file or directory at /usr/lib/perl5/5.8.6/i386-linux-thread-multi/DynaLoader.pm line 230. at ./mailgraph.pl line 360
> Compilation failed in require at ./mailgraph.pl line 360.
> BEGIN failed--compilation aborted at ./mailgraph.pl line 360.
>
> -bash-3.00#
>
> I tried to install the perl mods by:
>
>
> cd /src/rrdtool-1.3.1/bindings/perl-shared
> perl Makefile.PL
> make
> make test < -- This yielded one error - See below
>
>
> -bash-3.00# make test
>
> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
> t/base......Can't load '/usr/local/src/rrdtool-1.3.1/bindings/perl-shared/blib/arch/auto/RRDs/RRDs.so' for module RRDs: librrd.so.4: cannot open shared object file: No such file or directory at /usr/lib/perl5/5.8.6/i386-linux-thread-multi/DynaLoader.pm line 230.
> at t/base.t line 20
> Compilation failed in require at t/base.t line 20.
> BEGIN failed--compilation aborted at t/base.t line 20.
> t/base...... Dubious, test returned 255 (wstat 65280, 0xff00)
> Failed 7/7 subtests
>
> Test Summary Report
> -------------------
> t/base.t (Wstat: 65280 Tests: 1 Failed: 1)
> Failed test: 1
> Non-zero exit status: 255
> Parse errors: Bad plan. You planned 7 tests but ran 1.
> Files=1, Tests=1, 0 wallclock secs ( 0.01 usr 0.00 sys + 0.02 cusr 0.01 csys = 0.04 CPU)
> Result: FAIL
> Failed 1/1 test programs. 1/1 subtests failed.
> make: *** [test_dynamic] Error 255
>
> I am running an i386 on FC.
>
> Many thanks in advance!
>
> .vp
>
>
> --
> Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
> Help mailto:mailgraph-request@...?subject=help
> Archive http://lists.ee.ethz.ch/mailgraph
> WebAdmin http://lists.ee.ethz.ch/lsg2.cgi
>

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Need Help With RRD Perl Module Installation/Use

2008-09-05T12:09:09Z

Hello;

I am very new to this list. I've just installed RRDtool for the purpose of using it within the mailgraph perl script.

When I try to run the script, I get:

-bash-3.00# ./mailgraph.pl

Can't load '/usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi/auto/RRDs/RRDs.so' for module RRDs: librrd.so.4: cannot open shared object file: No such file or directory at /usr/lib/perl5/5.8.6/i386-linux-thread-multi/DynaLoader.pm line 230. at ./mailgraph.pl line 360
Compilation failed in require at ./mailgraph.pl line 360.
BEGIN failed--compilation aborted at ./mailgraph.pl line 360.

-bash-3.00#

I tried to install the perl mods by:

cd /src/rrdtool-1.3.1/bindings/perl-shared
perl Makefile.PL
make
make test < -- This yielded one error - See below

-bash-3.00# make test

PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/base......Can't load '/usr/local/src/rrdtool-1.3.1/bindings/perl-shared/blib/arch/auto/RRDs/RRDs.so' for module RRDs: librrd.so.4: cannot open shared object file: No such file or directory at /usr/lib/perl5/5.8.6/i386-linux-thread-multi/DynaLoader.pm line 230.
at t/base.t line 20
Compilation failed in require at t/base.t line 20.
BEGIN failed--compilation aborted at t/base.t line 20.
t/base...... Dubious, test returned 255 (wstat 65280, 0xff00)
Failed 7/7 subtests

Test Summary Report
-------------------
t/base.t (Wstat: 65280 Tests: 1 Failed: 1)
Failed test: 1
Non-zero exit status: 255
Parse errors: Bad plan. You planned 7 tests but ran 1.
Files=1, Tests=1, 0 wallclock secs ( 0.01 usr 0.00 sys + 0.02 cusr 0.01 csys = 0.04 CPU)
Result: FAIL
Failed 1/1 test programs. 1/1 subtests failed.
make: *** [test_dynamic] Error 255

I am running an i386 on FC.

Many thanks in advance!

.vp

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

interpret mailgraph graphs

2008-07-29T08:51:40Z

Hi,

How should we interpret the numbers in the graphs?

I understand sent and received, but is spam, rejected and virus a

subset from the sent and received?

Or can I add received and rejected and spam up to get the total amount

of messages which we have received?

Hope you can help me out.

Regards,

Epco

--
Epco Dijk
Meteo Consult B.V. - A MeteoGroup Company

Agro Business Park 99-101
Postbus 617, 6700 AP Wageningen
Tel: +31 (0)317 399800
Fax: +31 (0)317 423164
E-mail: E.Dijk@...
URL: <http://www.weer.nl/>

--

This e-mail is from Meteo Consult B.V., a MeteoGroup company. For more information, see http://www.weer.nl/gebruiksvoorwaarden.

This e-mail may contain confidential information. Only the addressee is permitted to read, copy, distribute or otherwise use this e-mail or any attachments. If you have received it in error, please contact the sender immediately. Any opinion expressed in this e-mail is personal to the sender and may not reflect the opinion of MeteoGroup.

Any e-mail reply to this address may be subject to interception or monitoring for operational reasons or for lawful business practices.

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

no spam records

2008-07-04T17:57:13Z

Hi,

I am using mailgraph 1.14 installed via FreeBSD ports, I have not any spam
records

Using amavisd-new-2.6.0

log says:

Jul 5 01:58:48 krasko amavis[2978]: (02978-06) Passed SPAMMY,
[1.2.3.4][1.2.3.4] <sender@...> -> <me@...>, Message-ID:
<20080704235848.69F2D2800767@...>, mail_id: 3+WTSrdQwO+K, Hits:
1001.449, size: 649, queued_as: 0A76322C48, 5469 ms

Any ideas?
Thanks
krasko

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: Imprecise total?

2008-05-29T05:52:28Z

Hi Sylvain,

On Mon, May 26, 2008 at 20:17:48 +0200, Sylvain Beucler wrote:
> I think there's a mistake in the graph's CDEF, more exactly when
> values are multiplied by $step (CDEF:drecv=recv,UN,0,recv,IF,$step,*).
> ...
> Unfortunately the archive uses 180 averages for 35 days (not 31), as
> it's created with a multiple of weekly rows:
> $month_steps = $week_steps*5 (cf. /usr/sbin/mailgraph).

You are right! Thanks for the bug report. I will fix it in the next
mailgraph.cgi in the same way as you propose it:

A straightforwarded "fix" is to change the graphs ranges:
my @graphs = (
{ title => 'Last Day', seconds => 3600*24, },
{ title => 'Last Week', seconds => 3600*24*7, },
# { title => 'Last Month', seconds => 3600*24*31, },
# { title => 'Last Year', seconds => 3600*24*365, },
{ title => 'Last Month', seconds => 3600*24*7*5, },
{ title => 'Last Year', seconds => 3600*24*7*5*12, },
);

Cheers
David

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Imprecise total?

2008-05-26T11:17:48Z

Hi,

I was trying to extract the sums (sent&received per day) from
mailgraph's monthly RRD archives, and I got different results.

I think there's a mistake in the graph's CDEF, more exactly when
values are multiplied by $step (CDEF:drecv=recv,UN,0,recv,IF,$step,*).

Step is computed on the assumption that 180 averages are used for the
graph. 180 is defined in mailgraph.cgi as
$xpoints(540)/$points_per_sample(3), that is, a graph of width 540
pixels where each value (RRA row) is 3 pixels wide.

Unfortunately the archive uses 180 averages for 35 days (not 31), as
it's created with a multiple of weekly rows:
$month_steps = $week_steps*5 (cf. /usr/sbin/mailgraph).

So the CDEF is using a $step computed with 3600*24*31/180=14880s,
while a point in the archive is really rrd.step * rra[2].pdp_per_row =
60*280 = 16800s. So monthly displayed values are about 10% less than
the actual values from the RRA.

This is confirmed by the value shown in rrdtool xport's <step>. An
xport for 31 days will also show 160 rows instead of 180.

Note that this problem does not occur for daily sums, because 180 rows
at 8 points/row are exactly 1 day (180*8*60 = 86400 = 60*60*24).

If you want to check/confirm, here's the xport command I used:
# Use multiples to select the right RRA (see rrdfetch(1))
TIME=$(date +%s)
#RRDRES=$((60*8)) # dayly = rrd.step * rra[0].pdp_per_row
RRDRES=$((60*280)) # monthly = rrd.step * rra[2].pdp_per_row
# DEF and CDEF are from mailgraph.cgi
rrdtool xport \
-e $(($TIME/$RRDRES*$RRDRES)) -s e-31d \
"DEF:sent=mailgraph.rrd:sent:AVERAGE" \
"CDEF:dsent=sent,UN,0,sent,IF,$RRDRES,*" \
"CDEF:ssent=PREV,UN,dsent,PREV,IF,dsent,+" \
"DEF:recv=mailgraph.rrd:recv:AVERAGE" \
"CDEF:rrecv=recv,60,*" \
"CDEF:drecv=recv,UN,0,recv,IF,$RRDRES,*" \
"CDEF:srecv=PREV,UN,drecv,PREV,IF,drecv,+" \
"DEF:spam=mailgraph_virus.rrd:spam:AVERAGE" \
"CDEF:dspam=spam,UN,0,spam,IF,$RRDRES,*" \
"CDEF:sspam=PREV,UN,dspam,PREV,IF,dspam,+" \
"DEF:virus=mailgraph_virus.rrd:virus:AVERAGE" \
"CDEF:rvirus=virus,60,*" \
"CDEF:dvirus=virus,UN,0,virus,IF,$RRDRES,*" \
"CDEF:svirus=PREV,UN,dvirus,PREV,IF,dvirus,+" \
"CDEF:recvlegit=srecv,svirus,sspam,+,-" \
XPORT:recvlegit:"total_received" \
XPORT:ssent:"total_sent" \
XPORT:dsent:"sent"

I had a look at Cacti, and it appears the sum is pre-computed before
graphing, and included in the graph as a comment (see "summation" in
http://docs.cacti.net/node/50).

Maybe mailgraph could use that technique as well?

Cheers,

--
Sylvain

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Re: Patch for mailgraph integrating css formatting

2008-05-26T07:24:50Z

Aki Parviainen wrote:
> Hello,
> On my Debian Etch servers Apache2 is configured so that serving css files from the cgi-bin directory doesn't work therefore
> the script's formatting doesn't look as intended. Because mailgraph.css was so short I added the formatting code to the main script.
> Here's the short patch agains 1.14 if anybody else is interested.
>
>

Oops, I see that the mailing list engine removed the patch and replaced
it with a download link that doesn't work for some reason. You can find
the patch from the following url instead:

http://hassut.fi/mailgraph.cgi.patch

Yours,

Aki

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi

Patch for mailgraph integrating css formatting

2008-05-26T05:18:33Z

Hello,
On my Debian Etch servers Apache2 is configured so that serving css files from the cgi-bin directory doesn't work therefore
the script's formatting doesn't look as intended. Because mailgraph.css was so short I added the formatting code to the main script.
Here's the short patch agains 1.14 if anybody else is interested.

Yours,

Aki

ps. If somebody needs I also have the same patch for the 1.14g2 (greylisting) version..

-- Attached file removed by Ecartis and put at URL below --
-- Type: text/plain
-- Size: 1k (1118 bytes)
-- URL : http://lists.ee.ethz.ch/p/02-mailgraph.cgi.csspatch

--
Unsubscribe mailto:mailgraph-request@...?subject=unsubscribe
Help mailto:mailgraph-request@...?subject=help
Archive http://lists.ee.ethz.ch/mailgraph
WebAdmin http://lists.ee.ethz.ch/lsg2.cgi