Re: monitoring outgoing emails

2018-04-05 Thread Poliman - Serwis
Thank you. I have to get all these message and try to build script which send me an email with specific number of emails send from particular email account. 2018-04-05 16:00 GMT+02:00 chaouche yacine : > > Yes, more specifically you should grep on 'Relay' to avoid other amavis > lines > > root@me

Re: monitoring outgoing emails

2018-04-05 Thread chaouche yacine
Yes, more specifically you should grep on 'Relay' to avoid other amavis lines root@messagerie[10.10.10.19] ~ # grep amavis /var/log/mail.log | grep -v Relay | head Apr  1 06:59:29 messagerie-prep amavis[25741]: starting. /usr/sbin/amavisd-new at myhost.mydomain.tld amavisd-new-2.10.1 (20141025

Re: monitoring outgoing emails

2018-04-05 Thread Poliman - Serwis
I wasn't able to find text "amavis" in log file. I tried production server and finally I see it and I know what you suggest me. It looks like: Apr 5 15:11:56 s1 amavis[26789]: (26789-13) Passed CLEAN {RelayedOutbound}, LOCAL [127.0.0.1] -> < s...@domain.com> Is it the line about which you said?

Re: monitoring outgoing emails

2018-04-05 Thread chaouche yacine
You didn't say what's wrong the line grepping on amavis ? it should give you what you want : one line by sender. On Thursday, April 5, 2018, 1:51:28 PM GMT+1, Poliman - Serwis wrote: I used this script and after comparison result generated by collate.pl and mail.log file I think tha

Re: monitoring outgoing emails

2018-04-05 Thread chaouche yacine
I was talking about collate.pl On Thursday, April 5, 2018, 12:04:45 PM GMT+1, Poliman - Serwis wrote: Yacine, do you say about collate.pl script or "from=" part from log file? I suppose that abotu script. If collate.pl could group by some id, it would be nice, because I would have on

Re: monitoring outgoing emails

2018-04-05 Thread Poliman - Serwis
Yacine, do you say about collate.pl script or "from=" part from log file? I suppose that abotu script. If collate.pl could group by some id, it would be nice, because I would have only one line from log dependent from particular email sent. 2018-04-05 12:31 GMT+02:00 chaouche yacine : > No it won

Re: monitoring outgoing emails

2018-04-05 Thread chaouche yacine
No it won't, it will simply group qids together so that you can trace individual e-mails, instead of having intermingled log lines from different e-mails. On Thursday, April 5, 2018, 7:10:11 AM GMT+1, Viktor Dukhovni wrote: > On Apr 5, 2018, at 2:07 AM, Poliman - Serwis wrote:

Re: monitoring outgoing emails

2018-04-04 Thread Viktor Dukhovni
> On Apr 5, 2018, at 2:07 AM, Poliman - Serwis wrote: > > Using collate.pl script I won't have to count "from=" from mail log, this > script merge it, am I right? Try it and see what you get. You may need to make some adjustments to the regular expressions depending on how your syslog forma

Re: monitoring outgoing emails

2018-04-04 Thread Poliman - Serwis
Using collate.pl script I won't have to count "from=" from mail log, this script merge it, am I right? 2018-04-05 7:57 GMT+02:00 Viktor Dukhovni : > > > > On Apr 5, 2018, at 1:39 AM, Scott Kitterman > wrote: > > > > On Thursday, April 05, 2018 07:34:44 AM Poliman - Serwis wrote: > >> Unfortunate

Re: monitoring outgoing emails

2018-04-04 Thread Viktor Dukhovni
> On Apr 5, 2018, at 1:39 AM, Scott Kitterman wrote: > > On Thursday, April 05, 2018 07:34:44 AM Poliman - Serwis wrote: >> Unfortunately I use Postfix from Ubuntu repos. > > apt-get source postfix > cd postfix-[version] (depends your Ubuntu release) > cd auxiliary/collate > ls > > and you'll

Re: monitoring outgoing emails

2018-04-04 Thread Scott Kitterman
On Thursday, April 05, 2018 07:34:44 AM Poliman - Serwis wrote: > Unfortunately I use Postfix from Ubuntu repos. apt-get source postfix cd postfix-[version] (depends your Ubuntu release) cd auxiliary/collate ls and you'll see both collate.pl and the associated README. Scott K > 2018-04-04 13:08

Re: monitoring outgoing emails

2018-04-04 Thread Poliman - Serwis
Unfortunately I use Postfix from Ubuntu repos. 2018-04-04 13:08 GMT+02:00 Wietse Venema : > Poliman - Serwis: > > Could you tell me I could add e-mails together from mail.log which are in > > line with "from=" part? Hmm I hope I say clear. I need count emails from > > particular mailbox. Can I ba

Re: monitoring outgoing emails

2018-04-04 Thread Poliman - Serwis
I am not sure I understood well. There are three "from=", and you said which one repond to which behavior, so I think I could base on "from=" from log file but I should divide by three number of emails send by specific user. Am I right? 2018-04-04 11:11 GMT+02:00 chaouche yacine : > The log line

Re: monitoring outgoing emails

2018-04-04 Thread Wietse Venema
Poliman - Serwis: > Could you tell me I could add e-mails together from mail.log which are in > line with "from=" part? Hmm I hope I say clear. I need count emails from > particular mailbox. Can I base on "from="? For example: > Apr 3 11:49:48 s1 postfix/qmgr[722]: 3B8C313BE2D: from=, > size=4000,

Re: monitoring outgoing emails

2018-04-04 Thread chaouche yacine
The log line from avmavis already has the sender a single time, regardless of the number of recipients. Also, if you grep on from, keep in mind that the email first goes from outside to postfix (1st from), the from postfix to amavis (second from), then from amavis back to postfix (third from).

Re: monitoring outgoing emails

2018-04-04 Thread Poliman - Serwis
Or maybe I could base on this value but divided by 3. 2018-04-04 9:43 GMT+02:00 Poliman - Serwis : > Hmm, probably I can't base on this, because when I send one email I have > in log three lines with "from=" and value . > 1st line --> Apr 4 09:32:41 s1 postfix/submission/smtpd[5622]: NOQUEUE: >

Re: monitoring outgoing emails

2018-04-04 Thread Poliman - Serwis
Hmm, probably I can't base on this, because when I send one email I have in log three lines with "from=" and value . 1st line --> Apr 4 09:32:41 s1 postfix/submission/smtpd[5622]: NOQUEUE: filter: RCPT from host-X.Y.Z.W.static.com[X.Y.Z.W]: < t...@example.com >: Sender address triggers FILTER amav

Re: monitoring outgoing emails

2018-04-03 Thread Poliman - Serwis
Could you tell me I could add e-mails together from mail.log which are in line with "from=" part? Hmm I hope I say clear. I need count emails from particular mailbox. Can I base on "from="? For example: Apr 3 11:49:48 s1 postfix/qmgr[722]: 3B8C313BE2D: from=, size=4000, nrcpt=1 (queue active) 201

Re: monitoring outgoing emails

2018-03-30 Thread Poliman - Serwis
Thank you for answer. I am going to use your command - without any typos :P - and wrap it by some bash script which will check the "Hits" value and send email with report. I hope I will do it. :) 2018-03-30 17:52 GMT+02:00 chaouche yacine : > Absolutely. Amavis comes with a default score of 5.0.

Re: monitoring outgoing emails

2018-03-30 Thread chaouche yacine
Absolutely. Amavis comes with a default score of 5.0. Any e-mail which has a 5.0 score or higher is considered spam. You might have false positives though, for example if the user's ISP addresses are blacklisted, which might be the case dependning on the country and ISP. Yassine. On Friday

Re: monitoring outgoing emails

2018-03-30 Thread Poliman - Serwis
Yassine, appreciate your answer. I will check further in it but do you think that spam score could help with estimate which mail from which account is or not spam? 2018-03-30 9:27 GMT+02:00 chaouche yacine : > Here are some ideas : > > 1/ Create a directory somewhere in /var/, for example mailst

Re: monitoring outgoing emails

2018-03-30 Thread chaouche yacine
Here are some ideas : 1/ Create a directory somewhere in /var/, for example mailstats2/ The directory will contain one file per sender3/ Your bash script will parse the mail log file in real time (tail -f) then tee each matching line to the corresponding mailstats/user file, for example if the

Re: monitoring outgoing emails

2018-03-29 Thread Poliman - Serwis
Some emails has "Hits" value even, for example 2,5. What is (if it's possible to say) good value? I am going to create script in bash which send me an email when from particular email account will outbound for example 300 emails per day. Kind of warning. But I am not sure I could use spam score to

Re: monitoring outgoing emails

2018-03-29 Thread chaouche yacine
It is, that's the spam score. It helps to visualise if a particular mailbox is bombarded with spam (can happen with lots and lots of e-mails from qq.com, I have that domain banned in postfix itself). Yassine. On Thursday, March 29, 2018, 3:21:16 PM GMT+1, Alex JOST wrote: Am 29.03.20

Re: monitoring outgoing emails

2018-03-29 Thread Alex JOST
Am 29.03.2018 um 15:30 schrieb Poliman - Serwis: This one works well. One question based on one from generated lines: Mar 26 11:47:41 ORIGINATING LOCAL [127.0.0.1]:38920 -> ,, Hits: 0.742 Mar 26 11:47:41 --> this is date and hour when mail from i...@klub-biosfera.pl was sent to i...@klub-biosf

Re: monitoring outgoing emails

2018-03-29 Thread Poliman - Serwis
-line-buffered -v ' > > (Process_Control| notifications.systemes| > PODCAST-|Admin-ch|PUB_CONTROL| @mydomain.tld|rpub@mydomain. tld' > > | sed -u 's/messagerie-prep amavis.*},//;s/Hits:\([^,]\+\) .*/HITS:\1/; > s/\ > > (Queue-ID\|Message-ID\).*, HITS/Hits/&

Re: monitoring outgoing emails

2018-03-29 Thread chaouche yacine
>  (Queue-ID\|Message-ID\).*, HITS/Hits/'|grep "$REGX_EMAIL ->" > >  This will strip out automatic notifications and give me output like this : > >  Mar 28 16:25:24 LOCAL [127.0.0.1]:47600 -> >  ,, Hits: -0.999 > >  One can tee this into a file and build from ther

Re: monitoring outgoing emails

2018-03-29 Thread Poliman - Serwis
ffered 'Relay' | egrep > --line-buffered -v ' > > (Process_Control| notifications.systemes| > PODCAST-|Admin-ch|PUB_CONTROL| @mydomain.tld|rpub@mydomain. tld' > > | sed -u 's/messagerie-prep amavis.*},//;s/Hits:\([^,]\+\) .*/HITS:\1/; > s/\ > > (

Re: monitoring outgoing emails

2018-03-29 Thread chaouche yacine
: > >  Mar 28 16:25:24 LOCAL [127.0.0.1]:47600 -> >  ,, Hits: -0.999 > >  One can tee this into a file and build from there. You can do basic stuff >with the (sort | uniq -c >  | sort -n) pipe machine. > >  On Wednesday, March 28, 2018, 3:09:24 PM GMT+1, Poliman - Serw

Re: monitoring outgoing emails

2018-03-29 Thread Poliman - Serwis
IL ->" > > > > This will strip out automatic notifications and give me output like > this : > > > > Mar 28 16:25:24 LOCAL [127.0.0.1]:47600 > -> > > ,, Hits: -0.999 > > > > > One can tee this into a file and build from there. You can d

Re: monitoring outgoing emails

2018-03-29 Thread chaouche yacine
dnesday, March 28, 2018, 3:09:24 PM GMT+1, Poliman - Serwis > >  wrote: > >  Thank you, I will check it. I am looking for information which linux user >sends email and how >  many, for example, per hour, day. That would be perfect plugin. > >  2018-03-28 15:59 GMT+02:0

Re: monitoring outgoing emails

2018-03-28 Thread Poliman - Serwis
a file and build from there. You can do basic > stuff with the (sort | uniq -c > > | sort -n) pipe machine. > > > > On Wednesday, March 28, 2018, 3:09:24 PM GMT+1, Poliman - Serwis < > ser...@poliman.pl> > > wrote: > > > > Thank you, I will che

Re: monitoring outgoing emails

2018-03-28 Thread Olivier
| sort -n) pipe machine. > > On Wednesday, March 28, 2018, 3:09:24 PM GMT+1, Poliman - Serwis > > wrote: > > Thank you, I will check it. I am looking for information which linux user > sends email and how > many, for example, per hour, day. That would be perfect plugin.

Re: monitoring outgoing emails

2018-03-28 Thread Poliman - Serwis
March 28, 2018, 3:09:24 PM GMT+1, Poliman - Serwis < > ser...@poliman.pl> wrote: > > > Thank you, I will check it. I am looking for information which linux user > sends email and how many, for example, per hour, day. That would be perfect > plugin. > > 2018-03-28 15:59

Re: monitoring outgoing emails

2018-03-28 Thread chaouche yacine
ect plugin. 2018-03-28 15:59 GMT+02:00 Matus UHLAR - fantomas : Poliman - Serwis: Hi people. Do you know is there any tool/plugin for monitoring outgoing emails from server with postfix? Maybe postfix has this feature? On 28.03.18 09:57, Wietse Venema wrote: Postfix logs all transactions.

Re: monitoring outgoing emails

2018-03-28 Thread Poliman - Serwis
ny tool/plugin for monitoring outgoing >>> emails from server with postfix? Maybe postfix has this feature? >>> >> > On 28.03.18 09:57, Wietse Venema wrote: > >> Postfix logs all transactions. I suggest that you look for tools >> that analyze Postfix logs. >

Re: monitoring outgoing emails

2018-03-28 Thread Matus UHLAR - fantomas
Poliman - Serwis: Hi people. Do you know is there any tool/plugin for monitoring outgoing emails from server with postfix? Maybe postfix has this feature? On 28.03.18 09:57, Wietse Venema wrote: Postfix logs all transactions. I suggest that you look for tools that analyze Postfix logs

Re: monitoring outgoing emails

2018-03-28 Thread Wietse Venema
Poliman - Serwis: > Hi people. Do you know is there any tool/plugin for monitoring outgoing > emails from server with postfix? Maybe postfix has this feature? Postfix logs all transactions. I suggest that you look for tools that analyze Postfix logs. Wietse

monitoring outgoing emails

2018-03-28 Thread Poliman - Serwis
Hi people. Do you know is there any tool/plugin for monitoring outgoing emails from server with postfix? Maybe postfix has this feature? -- *Pozdrawiam / Best Regards* *Piotr Bracha*