On Wed Jan 07, 2009 at 15:16:11 -0600, David Nicol wrote:
> Has anyone added a counter for results from installed plugins?
This is the past few hours from one of my MX machines:
19840 virus
5028 not a valid user
3816 missing reverse DNS
3743 from = to
2178 Unqualified helo
1768 DNS blacklist
680 urlbl
387 no Date
63 incomplete from
51 spam
16 body regexp
9 bad sender - Start with alphanumerical ids please
8 spamtrap
5 no from in message body
2 English mail only please
Total: 37594
Most of those should be self-explanatory - except perhaps "from = to", thats
a local plugin that does minimal testing to detect forged messages where
the sender is the same as the recipient address but it comes from a bogus
host.
The "unqualified helo" means that the original HELO greeting
didn't contain a period.
"no Date" means there was no Date: header in the message. "Incoming from"
means that the message body has a From: field with no "@" sign. Bad-sender
blocks "MAIL FROM: <[^a-zA-Z0-9]+>, ie MAIL FROM where the envelope sender
is not alphanumeric.
Steve
--
Debian GNU/Linux System Administration
http://www.debian-administration.org/
