On Fri, Sep 12, 2003 at 05:38:17PM -0400, [EMAIL PROTECTED] wrote:
> This might be an issue of scale.
Might be. How many simultaneous spamc processes do you usually have at any
given time?
> I'm probibly 800 messages every few minutes.
Do you also use any RBLs to reject anything at the SMTP stage? That keeps
a lot of mails away from having to be run through SA.
> Is the script you ran available for download?
It's an awk script I wrote (attached). Note that it is set up for Postfix,
but with a couple minor edits it will work correctly with Sendmail.
There's also a 'spamstats.pl' which someone else has written and has some
other features; it can be found here:
http://www.gryzor.com/tools/#spamstats
You may also want to try the SA timelog:
timelog_path /path/to/timelog
#!/usr/bin/awk -f
#
# $Id: spamstats.awk,v 1.2.1.3 2003/05/04 20:15:09 jamesb Exp $
#
{
if (/qmgr.*nrcpt=[1-9]+/) {
msgcount++
match($0, /size=[0-9]+/)
split(substr($0, RSTART, RLENGTH), sizearray, "=")
mailvolume = mailvolume + sizearray[2]
}
if (/ status=sent /)
numdelivered++
else if (/ reject: /)
numrejected++
else if (/ identified spam /) {
numspams++
match($0, /\([-0-9.]+\/[-0-9.]+\)/)
split(substr($0, RSTART + 1, RLENGTH - 1), spamscorearray, "/")
totalspamscore = totalspamscore + spamscorearray[1]
match($0, /in [0-9.]+ seconds/)
split(substr($0, RSTART, RLENGTH), timearray, " ")
totaltime = totaltime + timearray[2]
match($0, /[0-9.]+ bytes/)
split(substr($0, RSTART, RLENGTH), bytesarray, " ")
totalspambytes = totalspambytes + bytesarray[1]
if (spamscorearray[1] > maxspamscore)
maxspamscore = spamscorearray[1]
}
else if (/ clean message /) {
numclean++
match($0, /\([-0-9.]+\/[-0-9.]+\)/)
split(substr($0, RSTART + 1, RLENGTH - 1), cleanscorearray, "/")
totalcleanscore = totalcleanscore + cleanscorearray[1]
match($0, /in [0-9.]+ seconds/)
split(substr($0, RSTART, RLENGTH), timearray, " ")
totaltime = totaltime + timearray[2]
match($0, /[0-9.]+ bytes/)
split(substr($0, RSTART, RLENGTH), bytesarray, " ")
totalcleanbytes = totalcleanbytes + bytesarray[1]
if (cleanscorearray[1] < mincleanscore)
mincleanscore = cleanscorearray[1]
}
}
END {
nummessages = numdelivered + numrejected
numanalyzed = numspams + numclean
if (msgcount > 0)
avgmsgsize = mailvolume / msgcount
else
avgmsgsize = 0
if (nummessages > 0) {
percentdelivered = numdelivered / nummessages * 100
percentrejected = numrejected / nummessages * 100
}
else
percentdelivered = percentrejected = 0
if (numanalyzed > 0) {
percentspam = numspams / numanalyzed * 100
percentclean = numclean / numanalyzed * 100
avganalysistime = totaltime / numanalyzed
totalscore = totalspamscore + totalcleanscore
avgmsgscore = totalscore / numanalyzed
if (numspams > 0)
avgspamscore = totalspamscore / numspams
else
avgspamscore = 0
if (numclean > 0)
avgcleanscore = totalcleanscore / numclean
else
avgcleanscore = 0
totalbytes = totalspambytes + totalcleanbytes
if (totalbytes > 0) {
percentspambytes = totalspambytes / totalbytes * 100
percentcleanbytes = totalcleanbytes / totalbytes * 100
}
else
percentspambytes = percentcleanbytes = 0
}
else {
numanalyzed = 0
percentspam = percentclean = 0
avganalysistime = 0
totalscore = 0
avgmsgscore = 0
avgspamscore = avgcleanscore = 0
totalbytes = 0
percentspambytes = percentcleanbytes = 0
}
printf("%-35s: %10d\n", "Number of messages", nummessages)
printf("%-35s: %10d (%6.2f%%)\n", "Total rejected", numrejected,
percentrejected)
printf("%-35s: %10d (%6.2f%%)\n", "Total delivered", numdelivered,
percentdelivered)
printf("%-35s: %10d\n", "Total analyzed", numanalyzed)
printf("%-35s: %10.2f seconds\n", "Average analysis time", avganalysistime)
printf("%-35s: %10d (%6.2f%%)\n", "Number of clean messages", numclean,
percentclean)
printf("%-35s: %10d (%6.2f%%)\n", "Number of spams", numspams, percentspam)
printf("%-35s: %10.2f\n", "Minimum message score", mincleanscore)
printf("%-35s: %10.2f\n", "Maximum message score", maxspamscore)
printf("%-35s: %10.2f\n", "Average message score", avgmsgscore)
printf("%-35s: %10.2f\n", "Average clean score", avgcleanscore)
printf("%-35s: %10.2f\n", "Average spam score", avgspamscore)
printf("%-35s: %10.2f %s\n", "Average message size", avgmsgsize / 1024, "KB")
printf("%-35s: %10.2f %s\n", "Volume analyzed", totalbytes / 1024, "KB")
printf("%-35s: %10.2f %s (%6.2f%%)\n", "Clean volume", totalcleanbytes / 1024,
"KB", percentcleanbytes)
printf("%-35s: %10.2f %s (%6.2f%%)\n", "Spam volume", totalspambytes / 1024,
"KB", percentspambytes)
}
