On Wednesday 21 Sep 2005 18:29, Sloath wrote:
> Hi all,
>
> I have a system set-up according to the guide, with qmail logging using
> multilog to /var/log/qmail and using qmailmrtg7 for creating graphs.
>
> I've been investigating a few peaks in my messages/hour graph..
>
> Looking at the qmailmrtg7 code for counting messages... if increments a
> counter for every line that has a success, failure or deferral.
> Then at the end it returns two numbers, each multiplied by 12...
> (success*12, (failure+success)*12).
> It took me a few minutes to figure this out; it only counts messages
> from the last 300 seconds (5 minutes), and as we graph messages per hour
> it multiplies by 12 to get an hours worth... This turns 54 messages in
> the last 5 minutes into a plot of 648 messages/hour.
I found that out when I implemented a trigger on messages ;-)
>
> So when interpreting the 5 minute average graph, you have to look at any
> peak and divide by 12, to get the actual number of messages sent in the
> 5 minutes it represents....
>
> Wouldn't it be of more use to graph messages/5 minutes or a running
> total of messages per hour based on the actual previous 12 5-minute
> totals?
>
> Has anyone patched qmailmrtg7.c to allow it to take into account CHKUSER
> rejecting messages when counting SMTP totals? At the moment it only
> counts tcpserver and rblsmtpd deny messages.
hmm yes good point.
>
> Would simply adding the following(before line 291) to qmailmrtg7.c
> cover this?
> if ((tmpstr1 = strstr(TmpBuf, "CHKUSER rejected rcpt"))!=NULL) {
> --tallow;
> ++tdeny;
> }
I've added this to a copy of qmailmrtg7.c and ran make, fine, it's now
running, I'll watch the graph and see what happens, so far so good.
A quick look at the qmail-smtpd log showed a 'CHKUSER rejected relaying' so
I've changed the string to 'CHKUSER rejected' to catch them all
It won't catch 'CHKUSER no auth resource' or 'CHKUSER mbx overquota' but I've
never seen either in my logs and nor has logwatch.
patch is attached
HTH
--
-----------------
Bob Hutchinson
Midwales dot com
-----------------
Yes, I patched mine awhile back to give the 'actual' messages per 5 min interval instead of the 'hourly average' which is what it currently gives. Just took off the "*12". This seems to be a change in the most recent version(s) of qmailmrtg. I remember a year or so ago, it didn't do that...
I think...
--
Jason
[EMAIL PROTECTED]
